Oracle Unified Directory CVE-2026-60360

The attacker only needs network access to an Oracle Unified Directory instance's LDAP interface (per CVSS AV:N/AC:L/PR:N/UI:N) - no special product feature, configuration flag, or authentication is required against the affected supported versions 12.2.1.4.0 and 14.1.2.1.0. What limits exploitation in practice: the target must be running one of those exact affected versions, and the OUD LDAP listener (e.g., TCP 389/636/1389/1636) must be reachable from the attacker's network position, so instances confined to isolated internal segments face reduced exposure. Oracle publishes no further configuration prerequisites, so beyond version and network reachability there are no known non-default settings gating the attack.

This is a genuine top-priority issue rather than an inflated high-CVSS score: the vector is fully network-facing with no authentication, no user interaction, and low attack complexity, yielding the maximum 10.0 base score with a scope change. Oracle's own disclosure (secalert_us@oracle.com) and the 'Easily exploitable' language reinforce that exploitation is straightforward against the affected versions. Counterbalancing signals: no EPSS score was provided, the CVE is not in CISA KEV, and no proof-of-concept has surfaced - so there is currently no evidence of active or widespread exploitation, only high exploitability potential. There is no SSVC decision record in the input. The main uncertainty is that Oracle publishes no technical root cause or CWE, so defenders must treat 'takeover via LDAP' as the actionable fact while precise exploit prerequisites remain vendor-opaque.

An attacker with only network reachability to an OUD LDAP port sends specially crafted LDAP traffic to the OUD Core service and, without any credentials, gains full control of the directory instance. Because the flaw carries a scope change, the attacker can then leverage the compromised directory to affect other identity-dependent products in the environment. No public POC is known at time of analysis, but the low complexity and pre-auth nature make reliable exploitation plausible once details emerge.