Oracle Internet Directory — CVE-2026-61258 (Critical)

Date Aug 18, 2026

Type Vendor advisory

Signal Critical vendor advisory

Vendor / Product Oracle · Internet Directory

CVE CVE-2026-61258

Critical vendor advisory CVE-2026-61258

Summary

Vulnerability in the Oracle Internet Directory product of Oracle Fusion Middleware (component: OID LDAP Server). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via LDAP to compromise Oracle Internet Directory. Successful attacks of this vulnerability can result in takeover of Oracle Internet Directory. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

Why it matters

This CVE carries a CRITICAL severity rating (CVSS 9.8) in Oracle Internet Directory. Patch or mitigate promptly. EPSS percentile: 32%.

Operator check

Review CVE-2026-61258 in your asset inventory. Apply patches per vendor guidance and verify Internet Directory is not exposed. CVSS score: 9.8. EPSS probability: 0.4%; percentile: 32%.

Sources

NVD — CVE-2026-61258 Source reference

PatchBrief uses public sources. It does not scan environments, verify exposure, or replace vendor guidance.

Get watched-vendor alerts Subscribe free Back to feed