What is the CVSS score of CVE-2026-60362?

CVE-2026-60362 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Unified Directory are affected by CVE-2026-60362?

Oracle Unified Directory Core (versions 12.2.1.4.0 and 14.1.2.1.0) is vulnerable to complete remote takeover by unauthenticated network attackers accessing LDAP services, rated CRITICAL (CVSS 9.8).

How to fix or mitigate CVE-2026-60362?

Within 24 hours: Inventory all Oracle Unified Directory Core instances running versions 12.2.1.4.0 or 14.1.2.1.0; implement firewall rules restricting LDAP network access (ports 389 and 636) to authorized administrative hosts only; establish baseline monitoring and access logging. Within 7 days: Deploy network segmentation isolating affected OUD Core systems from general network traffic; enable detailed LDAP operation and authentication attempt logging; contact Oracle Support to establish patch timeline and interim mitigation options. Within 30 days: As patches become available from Oracle, apply immediately to all affected instances; conduct complete credential rotation for service accounts stored in the directory; perform comprehensive security validation and threat hunting on access logs for exploitation attempts; if patches are not released by day 30, implement long-term mitigation including system isolation and evaluation of alternative directory solutions.

Unified Directory CVE-2026-60362

EUVD-2026-46776 CRITICAL

Missing Authentication for Critical Function (CWE-306)

2026-07-21 secalert_us@oracle.com

GHSA-rpjf-56jj-f5ch

Authentication Bypass Oracle Unified Directory

9.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from Vendor (oracle) · only source for this CVE.

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 02:51 vuln.today

CVE Published

Jul 21, 2026 - 22:17 nvd

CRITICAL 9.8

DescriptionCVE.org

Vulnerability in the Oracle Unified Directory product of Oracle Fusion Middleware (component: OUD Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via LDAP to compromise Oracle Unified Directory. Successful attacks of this vulnerability can result in takeover of Oracle Unified Directory. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Complete takeover of Oracle Unified Directory (OUD Core) is achievable by an unauthenticated, network-based attacker communicating over LDAP against supported versions 12.2.1.4.0 and 14.1.2.1.0. Rated CVSS 3.1 9.8 with full confidentiality, integrity, and availability impact and marked 'easily exploitable' by Oracle, the flaw yields product compromise without credentials or user interaction. No public exploit identified at time of analysis and the issue is not currently listed in CISA KEV, but the trivial exploitation profile makes it a top patching priority.