CVE-2026-60519 in Unified Directory
Summary
by MITRE • 07/22/2026
Vulnerability in the Oracle Unified Directory product of Oracle Fusion Middleware (component: OUD Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows high privileged attacker with network access via LDAP to compromise Oracle Unified Directory. Successful attacks of this vulnerability can result in takeover of Oracle Unified Directory. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 07/22/2026
The vulnerability under discussion represents a critical security flaw within Oracle Unified Directory, a component of Oracle Fusion Middleware that serves as a centralized directory service for enterprise environments. This directory service plays a fundamental role in managing user identities, access controls, and authentication mechanisms across complex enterprise infrastructures. The affected versions 12.2.1.4.0 and 14.1.2.1.0 indicate this represents a long-term support release that has been widely deployed across enterprise environments, making the potential impact of this vulnerability significant for organizations relying on this directory service.
The technical flaw manifests as an easily exploitable vulnerability that specifically targets the OUD Core component through LDAP network protocols. This vulnerability requires only high privileged attacker access and network connectivity via LDAP to achieve successful exploitation, suggesting that the flaw exists within the authentication or authorization processing mechanisms of the directory service. The CVSS 3.1 base score of 7.2 indicates a high severity vulnerability that affects all three core security properties: confidentiality, integrity, and availability. The attack vector AV:N indicates network-based exploitation is possible, while AC:L suggests the attack requires minimal complexity to execute successfully. The PR:H designation shows that attackers must already possess elevated privileges, but these privileges are achievable through legitimate access paths within the environment.
The operational impact of this vulnerability extends far beyond typical directory service disruptions, as successful exploitation can result in complete compromise of the Oracle Unified Directory instance. This represents a critical escalation path where attackers who gain sufficient privileges can leverage this vulnerability to take full control of the directory service, potentially gaining access to all user identities, authentication credentials, and access control policies managed by the system. The implications are particularly severe given that directory services often serve as the foundation for enterprise authentication and authorization systems, making this a prime target for attackers seeking to establish persistent access within enterprise environments. Organizations may find their entire identity management infrastructure compromised, potentially leading to widespread unauthorized access across multiple systems that depend on the directory service for authentication.
The vulnerability aligns with CWE-284 (Improper Access Control) and reflects patterns commonly seen in directory service attacks where insufficient validation of privileged operations allows attackers to escalate their privileges beyond intended boundaries. From an ATT&CK framework perspective, this vulnerability maps to techniques involving privilege escalation and credential access, particularly targeting the credential repository aspect of enterprise security infrastructure. Organizations should implement immediate mitigations including network segmentation to restrict LDAP access, implementing additional authentication controls for directory service endpoints, and applying Oracle's official patches as soon as they become available. The vulnerability also highlights the importance of monitoring LDAP traffic for unusual patterns and maintaining strict access control policies for directory service administrative functions. Given that this affects multiple versions in the Oracle Unified Directory release cycle, organizations should conduct comprehensive assessments of their directory service deployments to identify all affected systems and prioritize remediation efforts accordingly.