Oracle Internet Directory vulnerabilities

17 CVEs affecting Oracle Internet Directory, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-83066, published 2026-09-15.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2019-0227, published 2019-05-01. High severity, CVSS 7.5. EPSS: 91.9% chance of exploitation in the next 30 days. A Server Side Request Forgery (SSRF) vulnerability affected the Apache Axis 1.4 distribution that was last released in 2006. Security and bug commits commits continue in the projects Axis 1.x…
CVE-2018-8032, published 2018-08-02. Medium severity, CVSS 6.1. EPSS: 10.6% chance of exploitation in the next 30 days. Apache Axis 1.x up to and including 1.4 is vulnerable to a cross-site scripting (XSS) attack in the default servlet/services.
CVE-2001-0975, published 2001-07-16. High severity, CVSS 7.5. EPSS: 8.8% chance of exploitation in the next 30 days. Buffer overflow vulnerabilities in Oracle Internet Directory Server (LDAP) 2.1.1.x and 3.0.1 allow remote attackers to execute arbitrary code, as demonstrated by the PROTOS LDAPv3 test suite.
CVE-2001-0974, published 2001-07-17. High severity, CVSS 7.5. EPSS: 6.3% chance of exploitation in the next 30 days. Format string vulnerabilities in Oracle Internet Directory Server (LDAP) 2.1.1.x and 3.0.1 allow remote attackers to execute arbitrary code, as demonstrated by the PROTOS LDAPv3 test suite.
CVE-2001-1321, published 2001-07-16. High severity, CVSS 7.5. EPSS: 5.8% chance of exploitation in the next 30 days. Oracle Internet Directory Server 2.1.1.x and 3.0.1 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via invalid encodings of BER OBJECT-IDENTIFIER…
CVE-2018-2601, published 2018-01-18. High severity, CVSS 8.0. EPSS: 1.7% chance of exploitation in the next 30 days. Vulnerability in the Oracle Internet Directory component of Oracle Fusion Middleware (subcomponent: Oracle Directory Services Manager). Supported versions that are affected are 11.1.1.7.0, 11.1.1.9.0…
CVE-2000-0987, published 2000-12-19. Medium severity, CVSS 4.6. EPSS: 1.4% chance of exploitation in the next 30 days. Buffer overflow in oidldapd in Oracle 8.1.6 allow local users to gain privileges via a long "connect" command line parameter.
CVE-2001-0300, published 2001-06-02. Low severity, CVSS 2.1. EPSS: 0.6% chance of exploitation in the next 30 days. oidldapd 2.1.1.1 in Oracle 8.1.7 records log files in a directory (ldaplog) that has world-writable permissions, which may allow local users to delete logs and/or overwrite other files via a symlink…
CVE-2026-83059, published 2026-09-15. Critical severity, CVSS 10.0. EPSS: 0.5% chance of exploitation in the next 30 days. Vulnerability in the Oracle Internet Directory product of Oracle Fusion Middleware (component: OID LDAP Server). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily…
CVE-2026-61241, published 2026-08-18. Critical severity, CVSS 10.0. EPSS: 0.5% chance of exploitation in the next 30 days. Vulnerability in the Oracle Internet Directory product of Oracle Fusion Middleware (component: OID LDAP Server). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily…

Latest

CVE-2026-83066, published 2026-09-15. Critical severity, CVSS 9.8. EPSS: 0.5% chance of exploitation in the next 30 days. Vulnerability in the Oracle Internet Directory product of Oracle Fusion Middleware (component: OID LDAP Server). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily…
CVE-2026-83062, published 2026-09-15. Critical severity, CVSS 9.8. EPSS: 0.5% chance of exploitation in the next 30 days. Vulnerability in the Oracle Internet Directory product of Oracle Fusion Middleware (component: OID LDAP Server). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily…
CVE-2026-83061, published 2026-09-15. Critical severity, CVSS 9.8. EPSS: 0.5% chance of exploitation in the next 30 days. Vulnerability in the Oracle Internet Directory product of Oracle Fusion Middleware (component: OID LDAP Server). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily…
CVE-2026-83060, published 2026-09-15. Critical severity, CVSS 9.8. EPSS: 0.5% chance of exploitation in the next 30 days. Vulnerability in the Oracle Internet Directory product of Oracle Fusion Middleware (component: OID LDAP Server). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily…
CVE-2026-83054, published 2026-09-15. Critical severity, CVSS 9.8. EPSS: 0.5% chance of exploitation in the next 30 days. Vulnerability in the Oracle Internet Directory product of Oracle Fusion Middleware (component: OID LDAP Server). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily…
CVE-2026-61258, published 2026-08-18. Critical severity, CVSS 9.8. EPSS: 0.5% chance of exploitation in the next 30 days. Vulnerability in the Oracle Internet Directory product of Oracle Fusion Middleware (component: OID LDAP Server). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily…
CVE-2026-61248, published 2026-08-18. Critical severity, CVSS 9.9. EPSS: 0.4% chance of exploitation in the next 30 days. Vulnerability in the Oracle Internet Directory product of Oracle Fusion Middleware (component: OID LDAP Server). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily…