EXPOSURES › CVE-2026-61248
CVE-2026-61248
CRITICALA critical LDAP server vulnerability in Oracle Internet Directory allows low-privileged attackers to take over the system via network access.
CVE-2026-61248 affects Oracle Internet Directory versions 12.2.1.4.0 and 14.1.2.1.0, enabling attackers to compromise the LDAP server and potentially impact additional products. DIB organizations must ensure these versions are patched immediately to prevent system takeover and data breaches. Failure to patch exposes the organization to significant confidentiality, integrity, and availability risks.
Shame score — A critical vulnerability with a CVSS score of 9.9 allows low-privileged attackers to take over the system, indicating a severe avoidable failure in Oracle's security posture.
▸ RECOMMENDED ACTION Remote code execution — patch the affected products on priority.
Vulnerability in the Oracle Internet Directory product of Oracle Fusion Middleware (component: OID LDAP Server). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows low privileged attacker with network access via LDAP to compromise Oracle Internet Directory. While the vulnerability is in Oracle Internet Directory, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Internet Directory. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).
| PRODUCT | STATUS |
|---|---|
| Aconex for Defense Oracle |
Authorized |
| Federal Managed Cloud Services Oracle |
Authorized |
| Fusion Cloud Oracle |
Authorized |
| Government Cloud - Common Controls Oracle |
Authorized |
| Oracle Cloud Infrastructure-Government Cloud Oracle |
Authorized |
| Oracle Enterprise Performance Management (EPM) Oracle |
Authorized |
| Oracle Enterprise Performance Management (EPM) - Moderate Oracle |
In Process |
| Oracle Service Cloud Oracle |
Authorized |
| Oracle Service Cloud (DOD) Oracle |
Authorized |
| Taleo Cloud - U.S. Government Cloud Oracle |
Authorized |