CVE-2026-60424 in Unified Directory
Summary
by MITRE • 07/22/2026
Vulnerability in the Oracle Unified Directory product of Oracle Fusion Middleware (component: OUD Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via LDAP to compromise Oracle Unified Directory. While the vulnerability is in Oracle Unified Directory, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Unified Directory. CVSS 3.1 Base Score 9.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H).
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 07/22/2026
This vulnerability resides within Oracle Unified Directory, a component of Oracle Fusion Middleware that serves as a centralized directory service for identity management and authentication. The affected versions 12.2.1.4.0 and 14.1.2.1.0 contain a critical flaw in the OUD Core component that enables unauthenticated attackers to compromise the system through LDAP network connections. The vulnerability's CVSS score of 9.0 reflects its high severity across confidentiality, integrity, and availability impacts, making it particularly dangerous for enterprise environments that rely on directory services for critical operations.
The technical nature of this flaw allows an attacker with only network access to exploit the system without requiring authentication credentials, which represents a significant security weakness in directory service architecture. The vulnerability's difficulty level is rated as hard to exploit, suggesting that while sophisticated attack techniques may be required, the potential for successful compromise remains high given the low barrier to entry through LDAP protocols. This characteristic aligns with CWE-284 (Improper Access Control) and potentially CWE-310 (Cryptographic Issues) depending on how authentication mechanisms are implemented within the LDAP service.
The operational impact of this vulnerability extends beyond the immediate Oracle Unified Directory system, as indicated by the scope change designation that suggests additional products may be affected. This cascading effect can occur because directory services often serve as foundational infrastructure components that other systems depend upon for authentication and authorization. Successful exploitation could result in complete system takeover, allowing attackers to gain full control over user identities, access permissions, and sensitive organizational data stored within the directory service. This represents a critical compromise that could enable lateral movement throughout the enterprise network.
Organizations should prioritize immediate mitigation efforts including implementing network segmentation to limit LDAP access, applying available patches from Oracle, and strengthening firewall rules to restrict unnecessary LDAP port exposure. The ATT&CK framework categorizes this vulnerability under T1078 (Valid Accounts) and potentially T1566 (Phishing) as attackers may leverage compromised directory services to establish persistent access. Additional defensive measures should include monitoring LDAP traffic for unusual patterns, implementing intrusion detection systems specifically configured to detect directory service attacks, and conducting regular security assessments of directory service configurations. The vulnerability's network accessibility makes it particularly attractive to automated attack tools that scan for exposed directory services, further emphasizing the urgency of remediation efforts.