CVE-2026-60429 in Unified Directory
Summary
by MITRE • 07/22/2026
Vulnerability in the Oracle Unified Directory product of Oracle Fusion Middleware (component: OUD Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows low privileged attacker with network access via LDAP to compromise Oracle Unified Directory. While the vulnerability is in Oracle Unified Directory, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Unified Directory. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 07/22/2026
This vulnerability resides within Oracle Unified Directory, a component of Oracle Fusion Middleware that serves as a comprehensive directory service for identity management and authentication. The affected versions 12.2.1.4.0 and 14.1.2.1.0 represent critical security gaps in the OUD Core functionality that enable malicious actors to gain unauthorized access to the directory service through LDAP protocols. The vulnerability's classification as easily exploitable indicates that attackers require minimal technical expertise or resources to leverage this flaw, making it particularly dangerous for organizations relying on Oracle Unified Directory for their identity infrastructure.
The technical flaw manifests as a privilege escalation vulnerability that allows low-privileged attackers with network-level access via LDAP to compromise the entire Oracle Unified Directory instance. This represents a fundamental breakdown in the directory service's authentication and authorization mechanisms, where properly configured access controls fail to prevent unauthorized operations. The vulnerability's impact extends beyond the immediate Oracle Unified Directory product through what is termed scope change, meaning that successful exploitation can potentially affect additional Oracle products within the same ecosystem, creating cascading security implications for enterprise environments.
From an operational perspective, this vulnerability presents a severe threat level with a CVSS base score of 9.9, indicating critical severity across all three core security principles. The confidentiality impact is high as attackers could access sensitive directory information including user credentials, organizational data, and authentication tokens stored within the directory service. Integrity impacts are equally concerning as malicious actors could modify directory entries, user permissions, or authentication configurations to maintain persistent access or disrupt legitimate operations. Availability risks include potential denial of service attacks that could render the directory service unusable for legitimate authentication requests.
The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) clearly demonstrates the vulnerability's characteristics with network accessibility, low attack complexity, and low privilege requirements. The scope change aspect (S:C) indicates that successful exploitation can affect additional products beyond the primary target, making this vulnerability particularly dangerous in complex enterprise environments where Oracle Unified Directory integrates with other Oracle Fusion Middleware components. Organizations should immediately implement mitigations including network segmentation to limit LDAP access, patching affected versions to the latest releases, and monitoring for unauthorized access attempts. This vulnerability aligns with CWE-284 (Improper Access Control) and maps to ATT&CK techniques involving credential access and privilege escalation through directory services.
Security teams must prioritize this vulnerability as it represents a critical attack surface that could enable comprehensive compromise of identity infrastructure. The low privilege requirements and network accessibility make it particularly attractive to attackers seeking persistent access to enterprise environments, while the scope change component means that remediation efforts must consider broader system impacts. Organizations should conduct immediate risk assessments to identify all instances of affected Oracle Unified Directory versions and implement layered security controls including LDAP traffic filtering, enhanced monitoring for anomalous directory queries, and regular vulnerability scanning of their identity infrastructure components. The potential for this vulnerability to enable further attacks through compromised directory credentials makes proactive remediation essential for maintaining overall enterprise security posture.