Oracle Unified Directory CVE-2026-46774

The attacker needs network reachability to Oracle Unified Directory's RMI endpoint on a host running OUD 12.2.1.4.0 or 14.1.2.1.0 with the OUD Core component active; per the CVSS vector (AV:N/AC:L/PR:N/UI:N), no authentication, no user interaction, and no special configuration are required beyond a running, network-reachable OUD instance. The primary limiting factor is therefore network exposure: in deployments where OUD RMI ports are firewalled to a management VLAN, exploitation requires prior foothold on a permitted host, while internet- or broad-LAN-exposed OUD instances are directly exploitable. Version is the other hard limit - only the two listed releases are confirmed affected; other OUD branches are out of scope of this CVE.

The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H represents Oracle's worst-case scoring class: remote, low-complexity, no authentication, no user interaction, with total CIA loss - a profile that historically correlates with rapid weaponization once a PoC drops. Counter-balancing signals: no EPSS score was provided, the vulnerability is not currently in CISA KEV, no public exploit code has been identified at time of analysis, and exposure depends on whether OUD's RMI listener is reachable from untrusted networks (in well-segmented Fusion Middleware deployments it is typically not internet-facing). The realistic risk is therefore very high inside enterprise/management networks where OUD RMI ports are reachable, and moderate-but-urgent for properly segmented deployments - treat as priority patching during the Oracle June 2026 CPU cycle rather than waiting for KEV confirmation. Note: CWE is missing from the input, so the deserialization classification above is inferred, not vendor-confirmed.

An attacker with network reachability to the OUD RMI port (e.g., from a compromised internal host or a misconfigured perimeter that exposes Fusion Middleware management ports) sends a crafted RMI request to the OUD Core service without supplying any credentials. The server processes the malicious object stream and the attacker achieves full takeover of the directory - enabling credential theft, password resets, and pivoting into every downstream application that trusts OUD for authentication. No public exploit identified at time of analysis, but Oracle's 'easily exploitable' wording and the AC:L rating suggest a PoC is straightforward to develop once the RMI entrypoint is identified.