CVE-2026-60427 in Unified Directory
Summary
by MITRE • 07/22/2026
Vulnerability in the Oracle Unified Directory product of Oracle Fusion Middleware (component: OUD Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via LDAP to compromise Oracle Unified Directory. While the vulnerability is in Oracle Unified Directory, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Unified Directory accessible data as well as unauthorized access to critical data or complete access to all Oracle Unified Directory accessible data. CVSS 3.1 Base Score 8.7 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N).
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 07/22/2026
This vulnerability exists within Oracle Unified Directory, a component of Oracle Fusion Middleware that serves as a directory service for identity management and authentication. The affected versions 12.2.1.4.0 and 14.1.2.1.0 represent critical flaws in the OUD Core component that can be exploited by unauthenticated attackers over network connections using LDAP protocols. The vulnerability's classification as difficult to exploit indicates that while sophisticated attack techniques are required, the potential impact remains severe enough to warrant immediate attention from security teams responsible for protecting enterprise directory services.
The technical nature of this flaw stems from insufficient authentication and authorization controls within the LDAP service implementation, allowing attackers to perform unauthorized operations against the directory database. This vulnerability operates at the core level of the directory service, meaning that successful exploitation can lead to complete compromise of the entire directory infrastructure. The CVSS 3.1 score of 8.7 reflects the high severity impact with both confidentiality and integrity affected, indicating that attackers could modify or delete critical data while also potentially gaining access to sensitive information stored within the directory system. The vector analysis shows network-based attack surface with high complexity requirements but no user interaction needed.
The operational impact extends far beyond the immediate Oracle Unified Directory system itself, as this vulnerability can cause scope changes affecting additional Oracle products that depend on or integrate with the directory service. This interconnectedness means that compromising a single directory instance could potentially undermine multiple applications and systems that rely on unified authentication mechanisms, creating cascading security failures throughout an organization's IT infrastructure. The ability to perform unauthorized creation, deletion, or modification operations represents a particularly dangerous capability that could lead to data corruption, information disclosure, or complete system compromise.
Organizations should implement immediate mitigations including network segmentation to restrict LDAP access to trusted systems only, deploying firewall rules to limit exposure of directory services to untrusted networks, and applying Oracle's security patches as soon as they become available. The vulnerability aligns with CWE-287 (Improper Authentication) and may map to ATT&CK techniques involving credential access and privilege escalation through service exploitation. Security teams should also conduct comprehensive audits of their directory service configurations, review access controls, and implement monitoring solutions to detect potential exploitation attempts against LDAP services that could indicate active attacks targeting this vulnerability.