EXPOSURES › CVE-2026-61258
CVE-2026-61258
CRITICALAn unauthenticated LDAP vulnerability in Oracle Internet Directory allows remote takeover of the server.
CVE-2026-61258 is a critical remote code execution flaw in Oracle Internet Directory that requires no authentication to exploit. DIB organizations must patch this immediately as it enables full server compromise, violating CMMC/NIST 800-171 requirements for system integrity and access control. Failure to patch exposes sensitive data and violates the principle of least privilege.
Shame score — A CVSS 9.8 vulnerability requiring no authentication to exploit represents a severe, avoidable failure in Oracle's security posture that directly threatens DIB data integrity and availability.
▸ RECOMMENDED ACTION Remote code execution — patch the affected products on priority.
Vulnerability in the Oracle Internet Directory product of Oracle Fusion Middleware (component: OID LDAP Server). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via LDAP to compromise Oracle Internet Directory. Successful attacks of this vulnerability can result in takeover of Oracle Internet Directory. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
| PRODUCT | STATUS |
|---|---|
| Aconex for Defense Oracle |
Authorized |
| Federal Managed Cloud Services Oracle |
Authorized |
| Fusion Cloud Oracle |
Authorized |
| Government Cloud - Common Controls Oracle |
Authorized |
| Oracle Cloud Infrastructure-Government Cloud Oracle |
Authorized |
| Oracle Enterprise Performance Management (EPM) Oracle |
Authorized |
| Oracle Enterprise Performance Management (EPM) - Moderate Oracle |
In Process |
| Oracle Service Cloud Oracle |
Authorized |
| Oracle Service Cloud (DOD) Oracle |
Authorized |
| Taleo Cloud - U.S. Government Cloud Oracle |
Authorized |