CVE-2026-60359 in Unified Directory
Summary
by MITRE • 07/22/2026
Vulnerability in the Oracle Unified Directory product of Oracle Fusion Middleware (component: OUD Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Unified Directory. While the vulnerability is in Oracle Unified Directory, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Unified Directory accessible data. CVSS 3.1 Base Score 8.6 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N).
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 07/22/2026
This vulnerability exists within Oracle Unified Directory, a component of Oracle Fusion Middleware that serves as a centralized directory service for identity management and authentication. The affected versions 12.2.1.4.0 and 14.1.2.1.0 contain a critical flaw in the OUD Core component that allows unauthenticated attackers to exploit network-based HTTP access points. The vulnerability demonstrates characteristics of a common weakness type categorized under CWE-287, which deals with authentication failures, specifically targeting improper authentication mechanisms within directory services. This flaw represents a significant security gap where an attacker can bypass authentication requirements entirely without requiring valid credentials or prior access privileges.
The technical exploitation of this vulnerability occurs through unauthenticated HTTP network connections to the Oracle Unified Directory service, making it particularly dangerous as it requires no initial authentication tokens or privileged access. The CVSS 3.1 scoring system rates this vulnerability at 8.6 out of 10, with a high confidentiality impact rating of 10.0, indicating that successful exploitation could result in unauthorized access to critical data or complete access to all directory accessible data within the Oracle Unified Directory environment. This represents a severe compromise of the system's integrity and confidentiality controls.
The operational impact extends beyond the immediate Oracle Unified Directory service, as the vulnerability demonstrates scope change characteristics that can affect additional Oracle products within the same ecosystem. This interconnectedness aligns with ATT&CK technique T1210, which involves exploitation of remote services and network-based attacks that can cascade across related systems. The vulnerability's ability to provide unauthorized access to critical data means organizations could face significant data breaches, identity theft, or disruption of authentication services that many enterprise applications depend upon for secure operations.
Organizations should implement immediate mitigations including network segmentation to restrict HTTP access to Oracle Unified Directory services, deployment of firewall rules to block unnecessary ports, and application of Oracle's official security patches as soon as they become available. The vulnerability's easily exploitable nature means that organizations should consider implementing intrusion detection systems to monitor for suspicious HTTP traffic patterns targeting directory services, while also conducting comprehensive assessments of their directory service configurations to identify any additional exposure points. Security teams must prioritize this vulnerability in their risk assessment frameworks due to its high severity score and potential for widespread impact across enterprise environments that rely on Oracle Fusion Middleware products for identity management operations.