CVE-2026-60361 in Unified Directory
Summary
by MITRE • 07/22/2026
Vulnerability in the Oracle Unified Directory product of Oracle Fusion Middleware (component: OUD Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows low privileged attacker with network access via LDAP to compromise Oracle Unified Directory. While the vulnerability is in Oracle Unified Directory, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Unified Directory. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 07/22/2026
This vulnerability resides within Oracle Unified Directory's OUD Core component and represents a critical security flaw affecting versions 12.2.1.4.0 and 14.1.2.1.0 of Oracle Fusion Middleware. The vulnerability's exploitability is characterized as easily accessible, requiring only low privilege attacker credentials and network access through the Lightweight Directory Access Protocol interface. This configuration creates a significant risk vector where malicious actors can leverage LDAP connections to compromise the entire Oracle Unified Directory system.
The technical nature of this flaw lies in the insufficient authorization controls within the OUD Core component, allowing authenticated but unprivileged users to execute operations that should require higher privileges. The vulnerability's impact extends beyond the immediate Oracle Unified Directory product, creating a scope change that can affect additional Oracle products within the middleware ecosystem. This cascading effect represents a sophisticated attack surface where compromise of one component can potentially lead to broader system infiltration.
The CVSS 3.1 base score of 9.9 reflects the severity of this vulnerability across all three core security principles: confidentiality, integrity, and availability. The attack vector AV:N indicates network-based exploitation without requiring physical access, while AC:L demonstrates low complexity in execution. The PR:L classification shows that attackers need only minimal privileges to exploit this flaw, making it particularly dangerous in environments where user access controls are not strictly enforced. The S:C designation reveals the scope change potential that can significantly amplify the impact beyond the targeted component.
From an operational perspective, successful exploitation of this vulnerability can result in complete system takeover, allowing attackers to gain full administrative control over Oracle Unified Directory operations. This compromise enables unauthorized access to directory services, potentially exposing sensitive organizational data including user credentials, access controls, and enterprise directory information. The confidentiality impact is particularly severe as directory services often contain privileged account information that could facilitate further attacks within the organization's infrastructure.
The availability impact of this vulnerability can manifest through service disruption, data corruption, or complete system unavailability, depending on how attackers choose to exploit the flaw. Integrity compromise occurs when attackers can modify directory entries, user permissions, or system configurations, potentially altering access controls and authorization mechanisms. This vulnerability aligns with CWE-284 (Improper Access Control) and represents a classic privilege escalation scenario that violates fundamental security principles.
Security practitioners should implement immediate mitigations including applying Oracle's security patches, restricting LDAP access through network segmentation, implementing strict authentication controls, and monitoring for unauthorized LDAP connections. The ATT&CK framework categorizes this vulnerability under privilege escalation techniques where attackers leverage insufficient access controls to gain elevated system privileges. Organizations should also consider implementing additional monitoring solutions focused on directory service activities and establishing incident response procedures specific to directory service compromises. The scope change aspect of this vulnerability emphasizes the importance of comprehensive security assessments that consider interconnected systems rather than isolated product vulnerabilities.