An unauthenticated attacker with network access to the LDAP interface of Oracle Unified Directory can compromise the system, allowing unauthorized access to critical data. The vulnerability results in a confidentiality impact and is rated with a CVSS v3.1 base score of 7.5. The weakness is related to improper access control, permitting attackers to read directory data without authentication.

Oracle Unified Directory version 12.2.1.4.0 and 14.1.2.1.0 are affected. These releases expose the LDAP service to the network without requiring authentication, creating a vector for data theft.

The CVSS score of 7.5 indicates a high severity, while the EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is remote, over an open LDAP port, allowing an attacker to connect without credentials. Given the direct unauthenticated access, exploitation is plausible for any adversary with network reach to the LDAP service, leading to potential data breaches.