Oracle Internet Directory — CVE-2026-61248 (Critical)

Date Aug 18, 2026

Type Vendor advisory

Signal Critical vendor advisory

Vendor / Product Oracle · Internet Directory

CVE CVE-2026-61248

Critical vendor advisory CVE-2026-61248

Summary

Vulnerability in the Oracle Internet Directory product of Oracle Fusion Middleware (component: OID LDAP Server). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows low privileged attacker with network access via LDAP to compromise Oracle Internet Directory. While the vulnerability is in Oracle Internet Directory, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Internet Directory. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Avail

Why it matters

This CVE carries a CRITICAL severity rating (CVSS 9.9) in Oracle Internet Directory. Patch or mitigate promptly. EPSS percentile: 28%.

Operator check

Review CVE-2026-61248 in your asset inventory. Apply patches per vendor guidance and verify Internet Directory is not exposed. CVSS score: 9.9. EPSS probability: 0.4%; percentile: 28%.

Sources

NVD — CVE-2026-61248 Source reference

PatchBrief uses public sources. It does not scan environments, verify exposure, or replace vendor guidance.

Get watched-vendor alerts Subscribe free Back to feed