CVE-2026-60850 in Unified Directory
Summary
by MITRE • 08/19/2026
Vulnerability in the Oracle Unified Directory product of Oracle Fusion Middleware (component: OUD Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via LDAP to compromise Oracle Unified Directory. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Unified Directory accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 08/19/2026
The identified vulnerability resides within the Oracle Unified Directory component of the Oracle Fusion Middleware suite, specifically affecting versions 12.2.1.4.0 and 14.1.2.1.0. This security flaw is classified as a critical authentication bypass issue that permits unauthenticated attackers to gain unauthorized access to sensitive information stored within the directory service. The vulnerability exploits weaknesses in how the Oracle Unified Directory handles Lightweight Directory Access Protocol requests, allowing an external actor with network connectivity to interact directly with the core services without providing valid credentials or passing standard security checks. This represents a significant failure in the implementation of authentication mechanisms and access control policies that are fundamental to maintaining the integrity and confidentiality of directory-based identity management systems.
From a technical perspective, this flaw aligns with CWE-287, which describes Improper Authentication, as well as CWE-306, Missing Authentication for Critical Function. The attacker leverages network-accessible LDAP endpoints to send specially crafted requests that bypass the expected authentication handshake or validation logic within the OUD Core engine. Because the vulnerability allows access without prior authentication, it effectively neutralizes one of the primary layers of defense in a typical enterprise identity infrastructure. The ease of exploitation is high due to the low complexity required and the lack of any prerequisite user interaction or specific victim actions beyond network reachability. This characteristic places the threat actor in a position where they can probe for this weakness using automated tools with minimal effort, increasing the likelihood of successful compromise in environments where such vulnerabilities are not actively monitored or patched.
The operational impact of exploiting this vulnerability is severe, primarily centered around data confidentiality and potential downstream integrity issues. A successful attack results in unauthorized access to critical data housed within Oracle Unified Directory, which typically contains user credentials, group memberships, organizational structures, and other sensitive identity attributes. The CVSS 3.1 base score of 7.5 reflects a high impact on confidentiality with no direct impact on availability or system integrity at the application level, although the indirect consequences for system integrity can be substantial if attackers use this access to modify directory entries or escalate privileges within connected applications that rely on OUD for authentication decisions. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) confirms that the attack is network-based, requires low complexity, involves no prior privileges, and does not require user interaction, while resulting in high confidentiality impact but unchanged integrity and availability scores for the directory service itself.
In terms of threat modeling and industry frameworks, this vulnerability maps to MITRE ATT&CK technique T1078, Valid Accounts, specifically when used by unauthorized actors through authentication bypass mechanisms, or potentially T1528, Steal Application Access Token if tokens are involved in the session establishment process. It also relates to initial access vectors where attackers exploit misconfigured services to establish a foothold within an organization's network perimeter. The ability to read critical data without authentication can facilitate further attacks such as credential stuffing, lateral movement using harvested identity information, or social engineering campaigns leveraging exposed organizational hierarchies and user details.
Mitigation strategies must focus on immediate patching and defensive configuration adjustments. Oracle has released patches for the affected versions 12.2.1.4.0 and 14.1.2.1.0; applying these updates is the most effective remediation step to close the authentication bypass gap in the OUD Core component. In environments where immediate patching is not feasible, network-level controls should be implemented to restrict LDAP traffic on port 389 or LDAPS on port 636 exclusively to trusted application servers and management stations rather than exposing these ports to untrusted networks. Additionally, implementing strict access control lists at the firewall level can limit exposure until the vulnerability is fully mitigated. Organizations should also audit their directory configurations for any other instances of weak authentication policies and ensure that monitoring solutions are tuned to detect anomalous LDAP query patterns indicative of exploitation attempts against this specific flaw.