A vulnerability in the Oracle Unified Directory Core component allows a low‑privileged attacker with network access to LDAP to compromise the directory service, potentially leading to full control over the system. The flaw results in severe confidentiality, integrity, and availability impacts, and is categorized as a CWE‑284 issue of improper access control. Successful exploitation can enable an attacker to modify, delete, or exfiltrate directory data, and to serve as a pivot point for further intrusions.

Oracle Unified Directory versions 12.2.1.4.0 and 14.1.2.1.0 are affected. These are part of Oracle Fusion Middleware and may be integrated with other Oracle products, so a breach of the directory can propagate to additional services.

The CVSS v3.1 score of 8.5 indicates high severity, and the attack vector is inferred to be remote over LDAP, requiring network access but no elevated privileges. The EPSS score is currently not available, so the likelihood of exploitation cannot be quantified, and the vulnerability is not listed in the CISA KEV catalog. Due to the potential for complete takeover and the scope change to other products, the risk remains high for any organization running the impacted versions and exposed to LDAP traffic.