Description
Vulnerability in the Oracle Unified Directory product of Oracle Fusion Middleware (component: OUD Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via LDAP to compromise Oracle Unified Directory. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Unified Directory accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).
Published: 2026-08-18
Score: 7.5 High
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability allows an unauthenticated attacker who can reach the Oracle Unified Directory service over LDAP to bypass authentication controls and gain full read access to the directory’s data. This breach could expose sensitive identity information and configuration data, potentially allowing the attacker to pivot further into the network. The weakness is an authentication bypass, documented as CWE-287.

Affected Systems

Oracle Unified Directory versions 12.2.1.4.0 and 14.1.2.1.0 are affected. The issue is present in the OUD Core component of Oracle Fusion Middleware and requires no credentials to exploit.

Risk and Exploitability

The CVSS 3.1 base score of 7.5 reflects a high confidentiality impact. Attack can be carried out over LDAP traffic from the network without authentication, making it highly accessible to attackers with network reach. EPSS is not available, but the vulnerability is not listed in CISA’s KEV catalog, suggesting current exploitation reports are unknown. Nonetheless, the potential for widespread data compromise warrants immediate remediation.

Generated by OpenCVE AI on August 18, 2026 at 23:42 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Install the Oracle Unified Directory security update that addresses the authentication bypass vulnerability.
  • Restrict LDAP traffic to trusted networks or apply IP‑based filtering to prevent unauthenticated connections.
  • Enable audit logging on the LDAP service and monitor for anomalous access attempts.

Generated by OpenCVE AI on August 18, 2026 at 23:42 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 19 Aug 2026 00:00:00 +0000

Type Values Removed Values Added
Title LDAP Authentication Bypass Enabling Full Oracle Unified Directory Compromise
Weaknesses CWE-287

Tue, 18 Aug 2026 21:15:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle Unified Directory product of Oracle Fusion Middleware (component: OUD Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via LDAP to compromise Oracle Unified Directory. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Unified Directory accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).
First Time appeared Oracle
Oracle unified Directory
CPEs cpe:2.3:a:oracle:unified_directory:12.2.1.4.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:unified_directory:14.1.2.1.0:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle unified Directory
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'}

Subscriptions

Oracle Unified Directory
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-08-18T20:59:14.175Z

Reserved: 2026-07-08T15:51:55.596Z

Link: CVE-2026-60850

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-08-18T21:16:45.010

Modified: 2026-08-18T21:16:45.010

Link: CVE-2026-60850

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-18T23:45:16Z

Weaknesses