What is the CVSS score of CVE-2026-60419?

CVE-2026-60419 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

How to fix or mitigate CVE-2026-60419?

Within 24 hours: Identify all systems running Oracle Unified Directory versions 12.2.1.4.0 or 14.1.2.1.0 and implement network-level LDAP access restrictions to only authorized internal systems; note that no vendor-released patch identified at time of analysis. Within 7 days: Conduct audit of LDAP user permissions to eliminate unnecessary elevated access, implement enhanced logging and alerting for all LDAP administrative operations, and establish thresholds for detecting suspicious privilege escalation attempts. Within 30 days: Contact Oracle for security updates and patch roadmap, evaluate migration to patched versions once available, and implement network segmentation to minimize blast radius if compromise occurs.

Oracle Unified Directory CVE-2026-60419

EUVD-2026-46817 HIGH

Improper Privilege Management (CWE-269)

2026-07-21 secalert_us@oracle.com

GHSA-3r88-xww2-vp8p

Privilege Escalation Oracle Unified Directory

8.8

CVSS 3.1 · Vendor: oracle

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Authenticate with low-privilege LDAP account
Delivery

Connect to OUD LDAP service
Exploit

Send crafted LDAP operation
Execution

Exploit OUD Core flaw
Persist

Escalate to directory takeover
Impact

Compromise stored identities and data

Vulnerability Assessment

Weakness	CWE CWE-269 OWASP Top 10:2025 A06:2025 - Insecure Design ASVS 5.0 V8 - Authorization Least privilege enforcement MITRE ATT&CK 1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	Exploitation requires network reachability to the OUD LDAP/LDAPS service and a valid low-privileged authenticated LDAP identity (CVSS PR:L) - this is not an unauthenticated flaw, so an attacker must first possess or acquire directory credentials, which is the primary limiting factor. The affected feature is the OUD Core LDAP request-processing path in Oracle Unified Directory 12.2.1.4.0 and 14.1.2.1.0 specifically; other versions and non-LDAP interfaces are not indicated. No special non-default configuration is called out by Oracle beyond the service being network-accessible over LDAP, and no user interaction is needed (UI:N), so any deployment exposing LDAP to a population of authenticated users is within scope.
Impact	The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, score 8.8) indicates a network-reachable, low-complexity attack requiring only low privileges and no user interaction, with total impact to confidentiality, integrity, and availability - consistent with Oracle's 'easily exploitable' and 'takeover' wording. The PR:L requirement is the main limiting factor: an attacker needs some existing authenticated LDAP identity, which reduces the pool of attackers versus a fully unauthenticated flaw but is trivially met in environments where OUD serves broad user populations. No EPSS score, KEV listing, or POC was provided in the intelligence sources, so real-world exploitation probability cannot be quantified from the data; the absence of KEV means no confirmed active exploitation at this time. A conflict to note: the feed tags this as 'Information Disclosure', yet the CVSS shows high integrity and availability impact and the description says 'takeover' - the tag understates the impact, so defenders should treat this as a full-compromise issue, not a read-only leak.
Exploit ScenarioDerived	An attacker who holds or obtains any low-privileged OUD directory account (for example, a standard end-user bind DN) connects to the exposed LDAP service over the network and sends crafted LDAP operations that abuse the OUD Core flaw to escalate privileges and take over the directory. Because attack complexity is low and no user interaction is required, the operation can be scripted and repeated reliably; no public proof-of-concept has been identified at time of analysis.

This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).

No patch listed yet 0.3% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jul 22, 2026

Takeover of Oracle Unified Directory is possible in the OUD Core component of Oracle Fusion Middleware versions 12.2.1.4.0 and 14.1.2.1.0, where a low-privileged attacker with network access over LDAP can fully compromise the directory service. Rated CVSS 3.1 8.8 with high confidentiality, integrity, and availability impact, Oracle describes the flaw as 'easily exploitable', meaning an authenticated LDAP user can escalate to full control of the directory. No public exploit has been identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and authenticated-user prerequisite make it a high priority for LDAP-exposed deployments.

RemediationAI

Apply the fixes from the Oracle July 2026 Critical Patch Update (https://www.oracle.com/security-alerts/cpujul2026.html), which is the authoritative source for the exact patched build/CPU level for OUD 12.2.1.4.0 and 14.1.2.1.0 - Oracle CPUs deliver cumulative patches rather than a single new version string, so verify the applicable interim patch number against your installed release. Until patched, reduce exposure by restricting LDAP and LDAPS listener access (typically TCP 389/636/1389/1636) to trusted management networks and application tiers via firewall or ACL rules, and tighten OUD access control instructions (ACIs) and password policies to limit what low-privileged bind accounts can do, since PR:L is the exploitation prerequisite. Review and prune unnecessary authenticated directory accounts and enable detailed LDAP audit logging to detect anomalous operations; note that network restrictions may break legitimate remote directory clients and should be validated against your integration topology before enforcement.

Affected VersionsENISA

Oracle Unified Directory 14.1.2.1.0

Oracle Unified Directory 12.2.1.4.0

Affected Packages

euvd oracle_unified_directory no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

Oracle Unified Directory (OUD) is Oracle's LDAPv3-compliant enterprise directory server, part of the Oracle Fusion Middleware stack and commonly used as an identity store, virtual directory, and proxy/replication tier for authentication across enterprise applications. The affected 'OUD Core' component is the underlying directory engine that processes LDAP protocol operations (bind, search, add, modify). The attack vector is explicitly the LDAP protocol (typically TCP 389/1389 or LDAPS 636/1636). No CWE was assigned by Oracle or NVD, so the precise root-cause class is not documented; the 'takeover' language combined with full C/I/A impact suggests an authorization/access-control or injection-class weakness in LDAP request handling rather than pure information disclosure, despite the 'Information Disclosure' tag in the intelligence feed.

Know when Unified Directory gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (oracle) PRIMARY 8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI 8.8 HIGH

LDAP is network-reachable (AV:N) with low complexity, requires an authenticated low-privileged bind (PR:L) and no user interaction; 'takeover' justifies full C/I/A high.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

DescriptionCVE.org

Vulnerability in the Oracle Unified Directory product of Oracle Fusion Middleware (component: OUD Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows low privileged attacker with network access via LDAP to compromise Oracle Unified Directory. Successful attacks of this vulnerability can result in takeover of Oracle Unified Directory. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

Executive ViewAI

Why It Matters

Oracle Unified Directory (OUD) Core in versions 12.2.1.4.0 and 14.1.2.1.0 contains a high-severity vulnerability (CVSS 8.8) allowing authenticated LDAP users to fully compromise the directory service. With no public exploit currently identified, this remains a critical risk to identity and access management operations, with potential for widespread impact across dependent systems.

Business Impact: High

Compensating Controls

Restrict LDAP network access via firewall to only authorized internal systems; eliminate unnecessary LDAP user privileges and maintain minimum required permissions; implement and monitor detailed logging of all LDAP administrative and authentication operations; deploy network segmentation to isolate OUD from untrusted network segments; establish incident response procedures for LDAP compromise scenarios.

Threat Intelligence Overview

EPSS Score

0.3%

Top 75% exploitable

Prevalence

Medium

enterprise LDAP directory, common in Oracle identity stacks but not universal

Data Quality

5 sources

Confidence: Medium

EUVD

NVD

CVE.org

EPSS

Vulnrichment

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC No

EPSS 0.3%

Patch available No

Active threat No

Deciding rule

HIGH severity (CVSS 7.0-8.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision

Scheduled

Exploitation

None

System Exposure· derived

Open

Automatable

Human Impact

High

Technical Impact

Total

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +44

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Privilege Escalation HIGH

Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.