CVE-2026-60360
Oracle Unified Directory (OUD) in Oracle Fusion Middleware has a critical flaw that lets an unauthenticated attacker with LDAP network access compromise the system. The vulnerability can lead to full takeover, affecting confidentiality, integrity, and availability. It applies to versions 12.2.1.4.0 and 14.1.2.1.0.
No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.
Who is affected
Oracle Unified Directory (OUD) component of Oracle Fusion Middleware, versions 12.2.1.4.0 and 14.1.2.1.0, used by organizations running Oracle Fusion Middleware.
Real-world impact
An attacker could take full control of the Oracle Unified Directory, potentially accessing or modifying sensitive data, disrupting services, and compromising other connected systems.
Why this severity
The CVSS score of 10 reflects that the vulnerability is exploitable from the network, requires no authentication, and can compromise confidentiality, integrity, and availability, with a change in scope indicating that other components may also be affected.
What to do about it
- ›No official fix available; monitor for vendor updates.
No official fix or mitigation is documented in the sources yet. Monitor the vendor advisory and apply the patch as soon as it is released.
No fix documented in sources
Timeline
- Jul 21, 2026 · 11d agoPublishedDisclosed and added to the National Vulnerability Database.
- Jul 28, 2026 · 4d agoAdvisory updatedThe NVD record was last revised.
How it’s attacked
References & advisories
- oracle.com/security-alerts/cpujul2026.…vendor advisory