CVE-2026-83059: Unauthenticated Remote Compromise in Oracle Internet Directory (OID) LDAP Server

HERMES

HERMES THREAT SCORE & DIRECTORY SERVICES SYSTEMIC RISK

Target: Oracle Internet Directory (OID) — Core LDAP Daemon (oidldapd) & Directory Storage Engine

Confidence: 99%

99 / 100

EXTREME

Measures real-world operational relevance, exploit weaponization, and active threat posture.

Dimension Breakdown

Exploitability 20 / 20

Threat Activity 20 / 20

Weaponization 20 / 20

Exposure 19 / 20

Prevalence 19 / 20

Impact 20 / 20

Exploit Maturity 20 / 20

Attack Chain Potential 20 / 20

⚖️ Divergence & Operational Rationale

CVSS v3.1 rates CVE-2026-83059 at the maximum 10.0 (Critical), and Hermes scores it at 99 (EXTREME). Oracle Internet Directory is an enterprise-grade LDAP directory service that stores corporate identities, security groups, access control lists, and hashed credentials for database enterprise user security (EUS). An unauthenticated remote attacker can exploit the LDAP protocol listener without credentials to achieve complete directory database compromise and host operating system control.

HASS

HASS AGENTIC SEVERITY & IDENTITY REPOSITORY SUBVERSION

Target: Enterprise Identity Store, Enterprise User Security (EUS) & LDAP Directory Replicas

Confidence: 97%

94 / 100

CRITICAL

Measures specific systemic risk arising from autonomy, tool authority, and cascading execution.

Dimension Breakdown

Autonomy 17 / 20

Tool Access 20 / 20

Privilege 20 / 15

Persistence 19 / 15

External Impact 19 / 15

Propagation 19 / 15

⚖️ Divergence & Operational Rationale

Compromising OID provides adversaries with total visibility and control over all enterprise user accounts, password hashes, and database mapping roles. Attackers can forge directory entries, dump user hashes, or alter authorization attributes across federated enterprise databases.

🕸️ Connected Knowledge Graph & Provenance

CVE-2026-83059: Unauthenticated Remote Compromise in Oracle Internet Directory (OID) LDAP ServerVULNERABILITY

Connected Nodes: 1

Active Relationships (Outgoing)

→ affectsPRODUCTMicrosoft Windows & Windows Server

98% VERY_HIGH

Software platform affected by security vulnerabilities and agentic attack patterns.

🔍 Why is this related? (Evidence & Provenance)

“Confirmed security vulnerability in Microsoft Windows & Windows Server documented in Hermes dossier.”

Supporting Verified Evidence:

• [vulnerability_report]
• [government_confirmation]CISA verified active exploitation in the wild and mandated federal remediation deadline in KEV entry. — Source: Cybersecurity & Infrastructure Security Agency (CISA): CISA Adds CVE-2026-59822 to Known Exploited Vulnerabilities Catalog (Reliability: VERY_HIGH)

Critical Advisory: Oracle September 2026 Critical Security Patch Update

CVSS v3.1: 10.0 Critical (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) / CWE-287: Improper Authentication / CWE-20: Improper Input Validation. Disclosed in the Oracle Critical Security Patch Update (CSPU) on September 15, 2026. Maximum CVSS base score of 10.0 with Scope Changed (S:C). Remotely exploitable without authentication over LDAP / LDAPS network ports (389, 636). Immediate patch application required across all OID instances.

Executive Summary

On September 15, 2026, Oracle published advisory CSPU September 2026, disclosing CVE-2026-83059, a maximum-severity (CVSS 10.0) flaw affecting the OID LDAP Server daemon (oidldapd) of Oracle Internet Directory (OID) (part of Oracle Fusion Middleware). The vulnerability enables remote, unauthenticated attackers to completely compromise the directory service via the LDAP protocol.

Oracle Internet Directory serves as the backbone directory service for Oracle Enterprise User Security (EUS), Oracle Database authentication, and Fusion Applications identity management. Because the vulnerability resides in the core ASN.1 BER message decoder of the oidldapd listening service on TCP ports 389 and 636, an attacker can transmit malformed LDAP requests without prior binding or authentication. Successful exploitation grants complete read and write control over directory tree objects (DIT), dumping password hashes (userPassword), modifying administrative access control lists (ACLs), or executing arbitrary code on the underlying server.

---

1. Technical Context & Affected Software Matrix

Oracle Internet Directory runs as a multi-threaded C-based daemon (oidldapd) backed by an Oracle Database repository to store schema, directory entries, and replication metadata.

Parameter	Technical Specification	Operational Impact
CVE Identifier	CVE-2026-83059	Oracle CSPU September 2026 / Advisory
Vulnerability Class	Input Validation Failure / Auth Bypass (CWE-20 / CWE-287)	ASN.1 BER message decoding flaw in LDAP listener
Affected Component	OID LDAP Server Daemon (oidldapd)	Core LDAP protocol handler listening on TCP 389 / 636
Protocol / Port	LDAP / LDAPS (TCP 389, 636, 3060, 3131)	Exposed across internal enterprise and database networks
Authentication Required	None (PR:N)	Attacker sends raw LDAP packets without binding
User Interaction	None (UI:N)	Autonomous machine-level exploitation
Scope Impact	Changed (S:C)	Extends to all databases relying on OID for Enterprise User Security
Privileges Obtained	Full OID Directory Takeover & Host OS Shell	Read/write of all directory entries and host code execution
Affected Versions	12.2.1.4.0 and 14.1.2.1.0	Active Oracle Internet Directory enterprise deployments
Remediation Target	September 2026 PSU for Oracle Internet Directory	Patch installation via OPatch and network access restrictions

---

2. Vulnerability Anatomy & Root Cause Analysis

ASN.1 BER Decoding Vulnerability in oidldapd

LDAP communication encodes directory operations (Bind, Search, Add, Modify) using the Abstract Syntax Notation One (ASN.1) Basic Encoding Rules (BER). When a client establishes a TCP connection to port 389 or 636, oidldapd processes incoming BER packets.

Prior to the September 2026 patch:

1. When parsing specific nested or malformed BER tag sequences (such as complex LDAP search filters or extended operation payloads), the BER decoding logic in oidldapd failed to validate length boundaries before allocating buffer memory.
2. An unauthenticated attacker could craft an LDAP packet containing negative length indicators or overlapping sequence tags, triggering a heap-based buffer overflow or logic bypass during packet parsing.
3. This unauthenticated memory corruption could be manipulated to overwrite internal thread security descriptors, allowing the attacker to bypass bind authentication entirely or achieve arbitrary shellcode execution within the memory space of oidldapd.

[Malicious LDAP Packet Structure]
0x30 [Universal Sequence] (Length: 0x84 ...)
  0x02 0x01 [MessageID: 1]
  0x60 [BindRequest] (Length: 0x84 ...)
    0x02 0x01 [Version: 3]
    0x04 [Name: ""] (Anonymous)
    0xA3 [Malformed Extended Auth Choice] -> Triggers BER length corruption in oidldapd

Once execution is achieved:

• The attacker directly queries the backend Oracle Database schema storing the OID directory entries.
• The attacker dumps all user and service account credentials (userPassword, Kerberos keys, and EUS database role mappings).
• The attacker modifies directory schema to inject backdoor administrator accounts (cn=Directory Manager).

---

3. Attack Flow & Weaponization Mechanics

sequenceDiagram
    autonumber
    actor Attacker as Remote Attacker (Unauthenticated)
    participant Listener as OID LDAP Port 389/636 (oidldapd)
    participant Memory as oidldapd Process Heap
    participant DB as OID Database Repository (ODS Schema)
    participant EUS as Enterprise Databases (EUS Clients)

    Attacker->>Listener: Transmit crafted ASN.1 BER LDAP packet (CVE-2026-83059)
    Listener->>Memory: Process BER tags without boundary enforcement
    Memory->>Memory: Heap buffer corruption / Security descriptor overwrite
    Note over Memory: Unauthenticated execution achieved in oidldapd process
    Listener-->>Attacker: Arbitrary read/write access granted to directory tree
    Attacker->>DB: Dump all userPassword hashes & database mapping roles
    Attacker->>DB: Inject rogue cn=Directory Manager administrator account
    Attacker->>EUS: Authenticate as DBA to enterprise databases via stolen EUS identities

---

4. Detection Engineering & Threat Hunting

Suricata Signature (Malformed LDAP)

alert tcp any any -> any [389,636,3060,3131] (
  msg:"HERMES THREAT - Oracle Internet Directory (OID) Malformed LDAP BER Exploit (CVE-2026-83059)";
  flow:to_server,established;
  content:"|30 84|"; depth:2;
  content:"|60 84|"; distance:2; within:10;
  pcre:"/0„[�-]{2}
.*`„/s";
  threshold:type limit, track by_src, count 1, seconds 60;
  reference:cve,2026-83059;
  reference:url,www.oracle.com/security-alerts/cspusep2026.html;
  classtype:attempted-admin;
  sid:202683059; rev:1;
)

OID Server Log Inspection

## Search OID server log files for process crashes or fatal BER decoding errors
grep -iE "FATAL|SIGSEGV|BER error|decoding error|oidldapd.*dumped core" \
  $ORACLE_INSTANCE/diagnostics/logs/OID/oid1/oidldapd01.log

## Check for unauthorized administrative operations in OID audit log
grep -E "op=modify|op=add" $ORACLE_INSTANCE/diagnostics/logs/OID/oid1/audit.log | grep "cn=Directory Manager"

Linux Core Dump Triage

## Check for recent core dumps generated by oidldapd
coredumpctl list /u01/app/oracle/middleware/bin/oidldapd 2>/dev/null || ls -la /var/crash/ | grep oidldapd

---

5. Forensic Investigation & Incident Response Playbook

When investigating suspected exploitation of CVE-2026-83059:

1. Process Integrity and Crash Analysis: Verify whether oidldapd crashed and restarted unexpectedly around the time of the incident:

   ps -ef | grep oidldapd
   uptime

2. Directory Modification Auditing: Examine OID audit logs (audit.log) for unauthorized schema modifications or additions to privileged directory groups:
   • Search for changes to cn=OAM Administrators, cn=Enterprise Security Admins, or cn=Directory Manager.
3. Database Repository Triage: Query the underlying ODS schema in the Oracle Database:

   SELECT entryid, dn, modifytimestamp, modifiersname
   FROM ods.ct_dn
   WHERE modifytimestamp >= SYSDATE - 7
   ORDER BY modifytimestamp DESC;

   Identify entries modified outside authorized change windows.
4. Credential Exposure & Enterprise Impact: Treat all credentials stored in OID as fully compromised. Plan immediate password rotations for all user accounts and database administrative identities mapped via Enterprise User Security.

---

6. Remediation, Patching & Hardening

1. Apply Oracle September 2026 Critical Security Patch Update: Apply the OID Patch Set Update (PSU) using OPatch:

   cd $ORACLE_HOME/OID_PATCH_SEP2026
   opatch apply

   Restart all OID instances (opmnctl restartproc ias-component=oid1).

2. Restrict Network Access to LDAP Ports: Block external and unprivileged network access to TCP ports 389, 636, 3060, and 3131. Allow connections exclusively from trusted application servers, WebLogic domains, and database listener subnets.

3. Enable Strict LDAP Auditing: Enable detailed access and administrative auditing within OID to log all search and modification requests with client IP addresses.

---

7. Related Intelligence & Attack Paths

Oracle Database Server Intelligence Understand how Enterprise User Security (EUS) integrates databases with OID.

Active Directory Kerberos & NTLM Forensics Compare enterprise directory service attacks across LDAP, OID, and Active Directory.

Oracle Access Manager Compromise (CVE-2026-71133) Analyze the identity provider compromise disclosed in the same Oracle CSPU.