CVE-2026-60424
A critical flaw in Oracle Unified Directory (OUD Core) lets an unauthenticated attacker with LDAP network access take control of the directory service. The vulnerability can also affect other Oracle Fusion Middleware components because the scope changes. It is hard to exploit but could lead to full compromise of the directory.
No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.
Who is affected
Oracle Unified Directory (OUD Core) in Oracle Fusion Middleware, versions 12.2.1.4.0 and 14.1.2.1.0. Administrators managing these directories are the typical users.
Real-world impact
An attacker could gain full control of the Oracle Unified Directory, potentially accessing or modifying sensitive data, disrupting services, and compromising other Oracle Fusion Middleware products that rely on the directory.
Why this severity
The CVSS score of 9 reflects that the flaw allows complete compromise of confidentiality, integrity, and availability, with a scope change that elevates the impact to other components. The attack requires only network access and no user interaction, but the high attack complexity lowers the score slightly.
What to do about it
No official fix or mitigation is documented in the sources yet. Monitor the vendor advisory and apply the patch as soon as it is released.
No fix documented in sources
Timeline
- Jul 21, 2026 · 11d agoPublishedDisclosed and added to the National Vulnerability Database.
- Jul 29, 2026 · 4d agoAdvisory updatedThe NVD record was last revised.
How it’s attacked
References & advisories
- oracle.com/security-alerts/cpujul2026.…vendor advisory