CVE-2026-35312

Critical · CVSS 9.8

Oracle Virtual Directory — Improper Access Control / Unauthenticated LDAP Remote Takeover (CWE-284)

CVSS: 9.8; nvd
EPSS: —
KEV: No
Class: other; CWE-284

Description

Vulnerability in the Oracle Virtual Directory product of Oracle Fusion Middleware (component: Virtual Directory Server). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via LDAP to compromise Oracle Virtual Directory. Successful attacks of this vulnerability can result in takeover of Oracle Virtual Directory. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

Search profile — drives PoC discovery

Symbols Oracle Virtual Directory ServerLDAPOVDFusion MiddlewareVirtual Directory Server componentunauthenticated LDAP access

Keywords CVE-2026-35312Oracle Virtual DirectoryOVD LDAP exploitOracle Fusion Middleware Virtual Directory PoCCVE-2026-35312 PoCOracle Virtual Directory unauthenticated takeoverOVD 12.2.1.4.0 vulnerabilityOVD 14.1.2.0.0 vulnerabilityOracle Virtual Directory LDAP RCECWE-284 Oracle Virtual Directory

Versions: 12.2.1.4.0, 14.1.2.0.0

References

https://www.oracle.com/security-alerts/cspujun2026.html

Status: enriched · ingested 2026-06-19T00:00:04.000Z · profiled 2026-06-19T00:30:04.000Z