CVE-2026-60421 in Unified Directory
Summary
by MITRE • 07/22/2026
Vulnerability in the Oracle Unified Directory product of Oracle Fusion Middleware (component: OUD Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Difficult to exploit vulnerability allows low privileged attacker with network access via LDAP to compromise Oracle Unified Directory. While the vulnerability is in Oracle Unified Directory, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Unified Directory accessible data as well as unauthorized access to critical data or complete access to all Oracle Unified Directory accessible data. CVSS 3.1 Base Score 8.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N).
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 07/22/2026
This vulnerability resides within Oracle Unified Directory, a component of Oracle Fusion Middleware that serves as a centralized directory service for identity management and authentication. The affected versions 12.2.1.4.0 and 14.1.2.1.0 represent critical flaws in the OUD Core module that can be exploited by low-privileged attackers with network-level access through the Lightweight Directory Access Protocol. The vulnerability's classification as difficult to exploit indicates that while the attack vector requires some specialized knowledge, the potential impact makes it particularly dangerous for organizations relying on this directory service for critical identity infrastructure.
The technical flaw manifests as a weakness in the LDAP protocol implementation that allows unauthorized modifications to directory data structures and access controls. Attackers can leverage this vulnerability to perform unauthorized operations including creating, deleting, or modifying sensitive directory entries that contain critical user accounts, group memberships, and authentication credentials. The scope change aspect indicates that successful exploitation may extend beyond just Oracle Unified Directory itself, potentially affecting other Oracle products that depend on or interact with the directory service for authentication and authorization purposes.
From a security impact perspective, this vulnerability represents a significant threat to organizational information security as it can result in complete compromise of directory data integrity and confidentiality. The CVSS 3.1 base score of 8.2 reflects the high severity of potential damage, with both confidentiality and integrity impacts rated as high. Attackers could gain unauthorized access to all data accessible through Oracle Unified Directory, including sensitive user information, system credentials, and privileged account details that would enable further lateral movement throughout the network infrastructure.
The operational impact extends far beyond immediate data compromise, potentially enabling attackers to establish persistent access within organizational networks while undermining trust in identity management systems. Organizations may experience cascading security failures as compromised directory entries could affect authentication services for multiple applications, databases, and enterprise systems that depend on Oracle Unified Directory for user validation. This vulnerability aligns with CWE-284 (Improper Access Control) and may map to ATT&CK techniques involving privilege escalation and credential access through directory service exploitation.
Mitigation strategies should include immediate patching of affected Oracle Unified Directory versions to address the identified vulnerability, implementing network segmentation to limit LDAP access to authorized systems only, and conducting comprehensive audit of directory permissions and access controls. Organizations should also consider deploying additional monitoring solutions specifically designed to detect anomalous LDAP activity patterns that might indicate exploitation attempts. Network-level controls including firewall rules restricting LDAP port 389 and LDAPS port 636 access to trusted IP ranges can significantly reduce attack surface while implementing principle of least privilege for directory service accounts helps limit potential damage from successful exploitation attempts.