CVE-2026-60437 in Unified Directory
Summary
by MITRE • 07/22/2026
Vulnerability in the Oracle Unified Directory product of Oracle Fusion Middleware (component: OUD Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows high privileged attacker with network access via LDAP to compromise Oracle Unified Directory. While the vulnerability is in Oracle Unified Directory, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Unified Directory accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Unified Directory. CVSS 3.1 Base Score 8.7 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:H).
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 07/22/2026
This vulnerability exists within Oracle Unified Directory's OUD Core component and represents a significant security flaw affecting versions 12.2.1.4.0 and 14.1.2.1.0 of Oracle Fusion Middleware. The vulnerability is classified as easily exploitable, requiring only network access via LDAP protocol and targeting high privileged attackers who can leverage their elevated privileges to compromise the system. This represents a critical weakness in the directory service infrastructure that serves as a foundational component for identity management across enterprise environments.
The technical nature of this vulnerability stems from insufficient access controls within the LDAP interface implementation, allowing authenticated users with administrative privileges to perform unauthorized operations against the directory service. The CVSS 3.1 score of 8.7 reflects the severity of impact across both integrity and availability dimensions, with the vector AV:N/AC:L/PR:H/UI:N/S:C indicating network-based exploitation requiring low complexity but high privilege levels. This vulnerability operates at the intersection of CWE-284 (Improper Access Control) and CWE-121 (Stack-based Buffer Overflow), demonstrating how inadequate privilege validation can lead to complete system compromise.
The operational impact of this vulnerability extends beyond the immediate Oracle Unified Directory service to potentially affect numerous dependent products within the Oracle Fusion Middleware ecosystem. This scope change aspect is particularly concerning as directory services often serve as central identity stores for multiple applications and services, meaning a compromise of the directory can cascade into broader system failures. Successful exploitation enables attackers to create, delete, or modify critical directory data, effectively undermining the integrity of the entire identity management infrastructure while simultaneously providing the capability to cause complete denial of service through system crashes.
Organizations must implement immediate mitigations including network segmentation to restrict LDAP access to trusted administrative networks, implementation of least privilege principles for LDAP accounts, and regular monitoring of directory service logs for unauthorized access attempts. The vulnerability's high severity necessitates urgent patching of affected versions, with additional defensive measures such as LDAP traffic inspection and behavioral anomaly detection systems. From an ATT&CK framework perspective, this vulnerability maps to T1078 (Valid Accounts) and T1499 (Endpoint Termination) techniques, as attackers can leverage legitimate administrative accounts to execute destructive operations while potentially causing system-wide outages that align with the T1486 (Data Destruction) tactic. Organizations should also consider implementing comprehensive incident response procedures specifically targeting directory service compromises, given the critical nature of this infrastructure component and its potential for widespread impact across enterprise environments.