What is the CVSS score of CVE-2026-60417?

CVE-2026-60417 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Oracle Unified Directory are affected by CVE-2026-60417?

Oracle Unified Directory (OUD Core) in Fusion Middleware versions 12.2.1.4.0 and 14.1.2.1.0 is vulnerable to unauthenticated remote takeover via the LDAP protocol, with CVSS 8.1 severity.

How to fix or mitigate CVE-2026-60417?

Within 24 hours, identify all Oracle Unified Directory instances running versions 12.2.1.4.0 or 14.1.2.1.0 in your environment and document network access paths to LDAP ports (default 389 and 636); apply firewall rules to restrict LDAP access to only known, trusted systems and segment OUD from untrusted networks. Within 7 days, deploy comprehensive monitoring and alerting for suspicious LDAP connection patterns, implement rate limiting on LDAP queries, enable detailed audit logging of all directory operations, and establish baseline metrics for normal LDAP traffic to support anomaly detection. Within 30 days, contact Oracle to confirm patching timelines and target versions, plan a prioritized upgrade strategy to the earliest available patched version, evaluate temporary failover to an alternative directory service if extended unpatched status is necessary, and audit all directory access logs for signs of prior exploitation.

Oracle Unified Directory CVE-2026-60417

EUVD-2026-46815 HIGH

Missing Authentication for Critical Function (CWE-306)

2026-07-21 secalert_us@oracle.com

GHSA-6xqp-6gg8-5wx6

Authentication Bypass Oracle Unified Directory

8.1

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.1 HIGH

Unauthenticated network LDAP reach gives AV:N/PR:N/UI:N; Oracle's 'difficult to exploit' supports AC:H; full server takeover justifies C:H/I:H/A:H with unchanged scope.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 03:35 vuln.today

CVE Published

Jul 21, 2026 - 22:17 nvd

HIGH 8.1

DescriptionCVE.org

Vulnerability in the Oracle Unified Directory product of Oracle Fusion Middleware (component: OUD Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via LDAP to compromise Oracle Unified Directory. Successful attacks of this vulnerability can result in takeover of Oracle Unified Directory. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Complete takeover of Oracle Unified Directory (OUD Core) is possible when a remote, unauthenticated attacker exploits a flaw reachable over the LDAP protocol in Oracle Fusion Middleware versions 12.2.1.4.0 and 14.1.2.1.0, per Oracle's July 2026 Critical Patch Update. Oracle rates the attack complexity as high, and a successful attack yields full confidentiality, integrity, and availability compromise (CVSS 8.1). There is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV, so exploitation would currently be theoretical or targeted rather than commodity.

Technical ContextAI

Oracle Unified Directory (OUD) is Oracle Fusion Middleware's enterprise LDAP directory server and storage/proxy/synchronization platform, commonly used as an identity data store backing authentication and authorization for enterprise applications. The affected component is OUD Core, and the exposed interface is the LDAP service (typically TCP 389/636 or the administration port). Oracle's disclosure does not assign a CWE (CWE: N/A) and provides no root-cause detail, but the combination of network-reachable LDAP, no privileges required, and full compromise is consistent with a protocol-parsing or authentication/authorization bypass class of defect in the LDAP request-handling path; the underlying weakness class cannot be confirmed from the available data.

RemediationAI

Apply the fixes delivered in the Oracle Critical Patch Update of July 2026 (https://www.oracle.com/security-alerts/cpujul2026.html) for the affected Oracle Unified Directory 12.2.1.4.0 and 14.1.2.1.0 releases; the advisory is the source of the exact patch bundle for each version, and no standalone fixed build number was provided in this data, so consult the CPU matrix for the precise patch. Because exploitation occurs over LDAP, compensating controls until patching include restricting network access to the OUD LDAP/LDAPS and administration ports to trusted management hosts and application tiers via firewall or network ACLs (trade-off: may break legitimate directory clients if scoping is too narrow), placing OUD behind an LDAP proxy or bastion, and enforcing TLS with strict client controls. These network controls reduce exposure but do not remediate the underlying flaw, so patching remains the primary action.