CVE-2026-60417

Analyzed Analyzed - Analysis Complete

Oracle Unified Directory Remote Code Execution

Publication date: 2026-07-21

Last updated on: 2026-07-29

Assigner: Oracle

Description

Vulnerability in the Oracle Unified Directory product of Oracle Fusion Middleware (component: OUD Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via LDAP to compromise Oracle Unified Directory. Successful attacks of this vulnerability can result in takeover of Oracle Unified Directory. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-21

Last Modified

2026-07-29

Generated

2026-08-11

AI Q&A

2026-07-22

EPSS Evaluated

2026-08-09

NVD

CVE-2026-60417

EUVD

EUVD-2026-46815

Affected Vendors & Products

Vendor	Product	Version / Range
oracle	unified_directory	12.2.1.4.0
oracle	unified_directory	14.1.2.1.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-306	The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Attack-Flow Graph

Executive Summary

This is a vulnerability in Oracle Unified Directory versions 12.2.1.4.0 and 14.1.2.1.0 that allows an unauthenticated attacker to remotely compromise the system via LDAP. Successful exploitation can lead to full takeover of the Oracle Unified Directory service.

Detection Guidance

Since this is a network-based vulnerability affecting Oracle Unified Directory via LDAP, detection involves checking for unauthorized access attempts or unusual LDAP queries targeting vulnerable versions (12.2.1.4.0 or 14.1.2.1.0). Monitor LDAP logs for suspicious activity and verify if the system is running an affected version. No specific commands are provided in the context.

Impact Analysis

An attacker could gain control of your Oracle Unified Directory, potentially accessing, modifying, or deleting sensitive data. This could disrupt services relying on the directory and lead to data breaches or unauthorized access.

Compliance Impact

This vulnerability could lead to unauthorized access or data breaches, violating GDPR (data protection) and HIPAA (health data privacy) requirements. Non-compliance may result in legal penalties, fines, or reputational damage.

Mitigation Strategies

Apply the latest Oracle Critical Patch Update for Oracle Unified Directory versions 12.2.1.4.0 and 14.1.2.1.0 to address the vulnerability.

Hi! I’m here to help you understand CVE-2026-60417. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70