Oracle Unified Directory CVE-2026-60361

Exploitation requires network access to the Oracle Unified Directory LDAP service and a low-privileged authenticated credential (CVSS PR:L) - it is not a fully unauthenticated flaw, so the attacker must first hold some valid directory account or bind DN. Beyond that, Oracle characterizes it as 'easily exploitable' with low attack complexity (AC:L) and no user interaction (UI:N), against the supported versions 12.2.1.4.0 and 14.1.2.1.0. The primary limiting factors defenders can rely on are: the need for at least a low-privilege credential, and reachability of the LDAP listener - restricting who can reach LDAP and who holds even minimal directory accounts materially reduces exposure. The scope change (S:C) means a successful compromise can extend beyond OUD to products that trust it.

All available signals point to high real-world risk. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) shows network exploitability, low complexity, only low privileges required, no user interaction, and a scope change with total impact - Oracle explicitly calls it 'easily exploitable.' The scope change (S:C) is the key amplifier: because OUD is a central identity/directory tier, compromise cascades to products that trust it for authentication. Tempering this, there is no CISA KEV listing and no public exploit identified at time of analysis, and no EPSS score was provided, so widespread active exploitation is not confirmed. Note a minor tension between the Oracle 'Information Disclosure' tag and the vector's full I:H/A:H impact - the tag understates the assessed integrity/availability consequences, so rely on the CVSS vector, which indicates far more than disclosure. Net: treat as a genuine priority driven by ease of exploitation and blast radius rather than by confirmed in-the-wild activity.

An attacker who already holds a low-privileged OUD account - for example a limited application bind DN or a compromised standard directory user - connects to the LDAP service over the network and issues crafted LDAP operations that abuse the flaw to escalate to full control of the directory. Having taken over OUD, they read or alter directory data and leverage OUD's trusted identity role to move into products that depend on it. No public exploit code is identified at time of analysis, but the low attack complexity means weaponization would be straightforward.