Description
Vulnerability in the Oracle Unified Directory product of Oracle Fusion Middleware (component: OUD Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows high privileged attacker with network access via LDAP to compromise Oracle Unified Directory. While the vulnerability is in Oracle Unified Directory, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Unified Directory accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Unified Directory. CVSS 3.1 Base Score 8.7 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:H).
Published: 2026-07-21
Score: 8.7 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability, a CWE‑284 access control flaw in Oracle Unified Directory (OUD Core), allows a high‑privileged attacker with LDAP network access to create, delete or modify critical data and to cause the directory service to hang or crash repeatedly. This results in significant loss of data integrity and a complete denial of service, potentially affecting any Fusion Middleware components that depend on OUD.

Affected Systems

Oracle Unified Directory versions 12.2.1.4.0 and 14.1.2.1.0 are affected. Additional Oracle Fusion Middleware components that rely on OUD may also experience elevated risk.

Risk and Exploitability

The CVSS v3.1 base score of 8.7 indicates a severe impact to integrity and availability, and the scope change increases the reach of the vulnerability. Despite an EPSS score of less than 1% and the vulnerability not being listed in the CISA KEV catalog, the network‑based attack vector via LDAP and requirement for high privileges make it a notable threat for exposed directories.

Generated by OpenCVE AI on August 2, 2026 at 22:20 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the security patch or upgrade to a fixed version as detailed in Oracle's CPU July 2026 security advisory.
  • Restrict LDAP traffic to the Oracle Unified Directory server to trusted internal networks or VPN connections, using firewalls and ACLs to limit access.
  • Enforce strict access controls on privileged LDAP operations and enable comprehensive audit logging to detect unauthorized changes or attempts.
  • If a patch cannot be applied immediately, isolate or temporarily disable the Oracle Unified Directory service from untrusted networks while monitoring for suspicious activity.

Generated by OpenCVE AI on August 2, 2026 at 22:20 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sun, 02 Aug 2026 22:45:00 +0000

Type Values Removed Values Added
Title LDAP Privilege Escalation and Denial of Service in Oracle Unified Directory

Sun, 26 Jul 2026 06:15:00 +0000

Type Values Removed Values Added
Title LDAP Privilege Escalation and Denial of Service in Oracle Unified Directory

Fri, 24 Jul 2026 18:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-284
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 21 Jul 2026 22:00:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle Unified Directory product of Oracle Fusion Middleware (component: OUD Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows high privileged attacker with network access via LDAP to compromise Oracle Unified Directory. While the vulnerability is in Oracle Unified Directory, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Unified Directory accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Unified Directory. CVSS 3.1 Base Score 8.7 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:H).
First Time appeared Oracle
Oracle unified Directory
CPEs cpe:2.3:a:oracle:unified_directory:12.2.1.4.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:unified_directory:14.1.2.1.0:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle unified Directory
References
Metrics cvssV3_1

{'score': 8.7, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:H'}

Subscriptions

Oracle Unified Directory
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-07-24T14:11:58.915Z

Reserved: 2026-07-08T15:51:40.537Z

Link: CVE-2026-60437

cve-icon Vulnrichment

Updated: 2026-07-24T14:11:43.350Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-02T22:30:04Z

Weaknesses