Description
Vulnerability in the Oracle Unified Directory product of Oracle Fusion Middleware (component: OUD Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via LDAP to compromise Oracle Unified Directory. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Unified Directory accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).
Published: 2026-08-18
Score: 7.5 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

An unauthenticated attacker with network access to the LDAP interface of Oracle Unified Directory can compromise the system, allowing unauthorized access to critical data. The vulnerability results in a confidentiality impact and is rated with a CVSS v3.1 base score of 7.5. The weakness is related to improper access control, permitting attackers to read directory data without authentication.

Affected Systems

Oracle Unified Directory version 12.2.1.4.0 and 14.1.2.1.0 are affected. These releases expose the LDAP service to the network without requiring authentication, creating a vector for data theft.

Risk and Exploitability

The CVSS score of 7.5 indicates a high severity, while the EPSS score is < 1%, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is remote, over an open LDAP port, allowing an attacker to connect without credentials. Given the direct unauthenticated access, exploitation is plausible for any adversary with network reach to the LDAP service, leading to potential data breaches.

Generated by OpenCVE AI on August 21, 2026 at 19:47 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the vendor‑released patch for Oracle Unified Directory 12.2.1.4.0 and 14.1.2.1.0 as soon as it becomes available.
  • Configure the LDAP service to require authentication before any directory access is granted.
  • Restrict LDAP traffic to trusted IP ranges using firewall rules or network segmentation.

Generated by OpenCVE AI on August 21, 2026 at 19:47 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 21 Aug 2026 20:15:00 +0000

Type Values Removed Values Added
Title Unauthenticated LDAP Access Allows Data Theft in Oracle Unified Directory

Fri, 21 Aug 2026 17:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-284
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 21 Aug 2026 16:30:00 +0000

Type Values Removed Values Added
Title Unauthenticated LDAP Access Allows Data Theft in Oracle Unified Directory

Fri, 21 Aug 2026 14:15:00 +0000

Type Values Removed Values Added
Title Unauthenticated LDAP Access Allows Unauthorized Data Retrieval in Oracle Unified Directory
Weaknesses CWE-284

Thu, 20 Aug 2026 15:30:00 +0000

Type Values Removed Values Added
Weaknesses NVD-CWE-noinfo

Tue, 18 Aug 2026 23:45:00 +0000

Type Values Removed Values Added
Title Unauthenticated LDAP Access Allows Unauthorized Data Retrieval in Oracle Unified Directory
Weaknesses CWE-284

Tue, 18 Aug 2026 21:15:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle Unified Directory product of Oracle Fusion Middleware (component: OUD Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via LDAP to compromise Oracle Unified Directory. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Unified Directory accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).
First Time appeared Oracle
Oracle unified Directory
CPEs cpe:2.3:a:oracle:unified_directory:12.2.1.4.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:unified_directory:14.1.2.1.0:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle unified Directory
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'}

Subscriptions

Oracle Unified Directory
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-08-21T16:35:24.947Z

Reserved: 2026-07-08T15:51:55.601Z

Link: CVE-2026-60914

cve-icon Vulnrichment

Updated: 2026-08-21T16:33:34.867Z

cve-icon NVD

Status : Modified

Published: 2026-08-18T21:16:47.347

Modified: 2026-08-21T17:16:33.073

Link: CVE-2026-60914

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-21T20:00:13Z

Weaknesses