What is the CVSS score of CVE-2026-60359?

CVE-2026-60359 has a CVSS 3.1 base score of 8.6 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N. EPSS exploitation probability: 0.4%.

Which versions of Oracle Unified Directory are affected by CVE-2026-60359?

Oracle Unified Directory (OUD Core) versions 12.2.1.4.0 and 14.1.2.1.0 contain an authentication bypass allowing unauthenticated remote attackers to access critical directory data.

How to fix or mitigate CVE-2026-60359?

Within 24 hours: Locate all instances of OUD Core 12.2.1.4.0 or 14.1.2.1.0 in your environment and assess network exposure; restrict HTTP access to directory services if operationally feasible. Within 7 days: Implement network segmentation to limit directory access to authorized administrative networks only, deploy Web Application Firewall rules to detect suspicious directory queries, and enable comprehensive access logging on all directory operations. Within 30 days: Monitor Oracle security advisories for a vendor patch release, develop an upgrade strategy to a patched version, and establish a remediation timeline with business stakeholders.

Oracle Unified Directory CVE-2026-60359

EUVD-2026-46773 HIGH

Missing Authentication for Critical Function (CWE-306)

2026-07-21 secalert_us@oracle.com

GHSA-x584-wv8x-x4mr

Authentication Bypass Oracle Unified Directory

8.6

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.6 HIGH

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

vuln.today AI

8.6 HIGH

Remote unauthenticated HTTP access (AV:N/AC:L/PR:N/UI:N) with an authentication bypass yielding directory data disclosure and cross-product scope change (S:C, C:H), no integrity or availability impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 02:49 vuln.today

CVE Published

Jul 21, 2026 - 22:17 nvd

HIGH 8.6

DescriptionCVE.org

Vulnerability in the Oracle Unified Directory product of Oracle Fusion Middleware (component: OUD Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Unified Directory. While the vulnerability is in Oracle Unified Directory, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Unified Directory accessible data. CVSS 3.1 Base Score 8.6 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N).

AnalysisAI

Unauthorized data access in Oracle Unified Directory (OUD Core) 12.2.1.4.0 and 14.1.2.1.0 lets a remote unauthenticated attacker reach critical directory data over HTTP, with a scope change that can spill impact into other products relying on the directory. Oracle rates it CVSS 3.1 8.6 with high confidentiality impact and no integrity or availability effect, and tags it as an authentication bypass. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Technical ContextAI

Oracle Unified Directory is Oracle's Java-based LDAP directory service and part of the Oracle Fusion Middleware / Oracle Identity Management stack, typically used as an enterprise identity store, virtual directory, and proxy. The flaw sits in the OUD Core component and is exercised over HTTP (AV:N), consistent with OUD's administrative/REST or directory HTTP listeners rather than the raw LDAP port. The vendor tag 'Authentication Bypass' aligns with the CVSS profile (PR:N, C:H, I:N, A:N): an attacker who should have to authenticate can instead read protected directory data. No CWE was supplied by NVD, but the behavior maps to an improper authentication / access-control weakness class (broadly CWE-287/CWE-284). Because OUD is frequently a central identity provider, the scope change (S:C) means the compromised confidentiality boundary extends to downstream applications and systems that trust the directory.

RemediationAI

Apply the Oracle Critical Patch Update of July 2026, which is the vendor advisory carrying the fix for this issue (Patch available per vendor advisory: https://www.oracle.com/security-alerts/cpujul2026.html) - locate and apply the OUD 12.2.1.4.0 and 14.1.2.1.0 bundle/interim patches referenced there, as Oracle did not publish a separate fixed build string in the available data, so confirm the exact patch number in the CPU matrix. Until patched, reduce exposure by restricting network access to OUD's HTTP/administrative listeners to trusted management networks and identity clients only (firewall/ACL to the affected HTTP port), placing OUD behind a reverse proxy or WAF that enforces authentication, and removing any internet exposure of the directory; the trade-off is that overly tight ACLs can break legitimate application binds and provisioning flows, so validate downstream identity integrations after locking down. Because impact is confidentiality-only, also rotate or monitor high-value credentials and secrets stored in the directory as a precaution.