Description
Vulnerability in the Oracle Unified Directory product of Oracle Fusion Middleware (component: OUD Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Difficult to exploit vulnerability allows low privileged attacker with network access via LDAP to compromise Oracle Unified Directory. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Unified Directory accessible data as well as unauthorized access to critical data or complete access to all Oracle Unified Directory accessible data. CVSS 3.1 Base Score 6.8 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N).
Published: 2026-08-18
Score: 6.8 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A vulnerability in Oracle Unified Directory permits a low‑privileged attacker with LDAP network access to create, delete, or modify critical data without proper authorization. This flaw can lead to unauthorized changes to directory entries, compromising confidentiality and integrity of stored information.

Affected Systems

Oracle Unified Directory versions 12.2.1.4.0 and 14.1.2.1.0 are vulnerable.

Risk and Exploitability

The CVSS 3.1 score of 6.8 signals moderate severity with high confidentiality and integrity impacts. Exploitation requires LDAP connectivity and a low‑privilege account; the weakness is described as difficult to exploit. The EPSS score is < 1%, indicating a very low expected exploitation probability, and it is not listed in CISA KEV. Nevertheless, an attacker who can reach the LDAP interface could gain unauthorized access to all directory data and alter it at will.

Generated by OpenCVE AI on August 21, 2026 at 21:11 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Install the vendor‑supplied patch for Oracle Unified Directory 12.2.1.4.0 and 14.1.2.1.0.
  • Apply network segmentation and enforce least‑privilege controls to restrict LDAP access to trusted hosts and accounts.
  • Enable and review Oracle Unified Directory audit logs to detect anomalous creation, deletion, or modification events and set up alerts for unauthorized activity.

Generated by OpenCVE AI on August 21, 2026 at 21:11 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 21 Aug 2026 21:45:00 +0000

Type Values Removed Values Added
Title Low-Privilege LDAP Vulnerability Allows Unauthorized Directory Modifications in Oracle Unified Directory

Fri, 21 Aug 2026 19:15:00 +0000

Type Values Removed Values Added
Title LDAP Access Allows Unauthorized Directory Modification
Weaknesses CWE-285

Fri, 21 Aug 2026 17:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-284

Fri, 21 Aug 2026 16:15:00 +0000

Type Values Removed Values Added
Title LDAP Access Allows Unauthorized Directory Modification
Weaknesses CWE-285

Fri, 21 Aug 2026 14:30:00 +0000

Type Values Removed Values Added
Title Low-Privilege LDAP Vulnerability Allows Unauthorized Data Manipulation in Oracle Unified Directory
Weaknesses CWE-284
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Thu, 20 Aug 2026 15:30:00 +0000

Type Values Removed Values Added
Weaknesses NVD-CWE-noinfo

Wed, 19 Aug 2026 00:00:00 +0000

Type Values Removed Values Added
Title Low-Privilege LDAP Vulnerability Allows Unauthorized Data Manipulation in Oracle Unified Directory
Weaknesses CWE-284

Tue, 18 Aug 2026 21:15:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle Unified Directory product of Oracle Fusion Middleware (component: OUD Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Difficult to exploit vulnerability allows low privileged attacker with network access via LDAP to compromise Oracle Unified Directory. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Unified Directory accessible data as well as unauthorized access to critical data or complete access to all Oracle Unified Directory accessible data. CVSS 3.1 Base Score 6.8 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N).
First Time appeared Oracle
Oracle unified Directory
CPEs cpe:2.3:a:oracle:unified_directory:12.2.1.4.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:unified_directory:14.1.2.1.0:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle unified Directory
References
Metrics cvssV3_1

{'score': 6.8, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N'}

Subscriptions

Oracle Unified Directory
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-08-21T16:46:36.834Z

Reserved: 2026-07-08T15:51:55.600Z

Link: CVE-2026-60895

cve-icon Vulnrichment

Updated: 2026-08-21T14:06:32.216Z

cve-icon NVD

Status : Modified

Published: 2026-08-18T21:16:46.647

Modified: 2026-08-21T17:16:32.943

Link: CVE-2026-60895

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-21T21:30:17Z

Weaknesses