What is the CVSS score of CVE-2026-60419?

CVE-2026-60419 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Oracle Unified Directory are affected by CVE-2026-60419?

Oracle Unified Directory (OUD) Core in versions 12.2.1.4.0 and 14.1.2.1.0 contains a high-severity vulnerability (CVSS 8.8) allowing authenticated LDAP users to fully compromise the directory…

How to fix or mitigate CVE-2026-60419?

Within 24 hours: Identify all systems running Oracle Unified Directory versions 12.2.1.4.0 or 14.1.2.1.0 and implement network-level LDAP access restrictions to only authorized internal systems; note that no vendor-released patch identified at time of analysis. Within 7 days: Conduct audit of LDAP user permissions to eliminate unnecessary elevated access, implement enhanced logging and alerting for all LDAP administrative operations, and establish thresholds for detecting suspicious privilege escalation attempts. Within 30 days: Contact Oracle for security updates and patch roadmap, evaluate migration to patched versions once available, and implement network segmentation to minimize blast radius if compromise occurs.

Oracle Unified Directory CVE-2026-60419

EUVD-2026-46817 HIGH

Improper Privilege Management (CWE-269)

2026-07-21 secalert_us@oracle.com

GHSA-3r88-xww2-vp8p

Privilege Escalation Oracle Unified Directory

8.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

LDAP is network-reachable (AV:N) with low complexity, requires an authenticated low-privileged bind (PR:L) and no user interaction; 'takeover' justifies full C/I/A high.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 03:35 vuln.today

CVE Published

Jul 21, 2026 - 22:17 nvd

HIGH 8.8

DescriptionCVE.org

Vulnerability in the Oracle Unified Directory product of Oracle Fusion Middleware (component: OUD Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows low privileged attacker with network access via LDAP to compromise Oracle Unified Directory. Successful attacks of this vulnerability can result in takeover of Oracle Unified Directory. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Takeover of Oracle Unified Directory is possible in the OUD Core component of Oracle Fusion Middleware versions 12.2.1.4.0 and 14.1.2.1.0, where a low-privileged attacker with network access over LDAP can fully compromise the directory service. Rated CVSS 3.1 8.8 with high confidentiality, integrity, and availability impact, Oracle describes the flaw as 'easily exploitable', meaning an authenticated LDAP user can escalate to full control of the directory. No public exploit has been identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and authenticated-user prerequisite make it a high priority for LDAP-exposed deployments.

Technical ContextAI

Oracle Unified Directory (OUD) is Oracle's LDAPv3-compliant enterprise directory server, part of the Oracle Fusion Middleware stack and commonly used as an identity store, virtual directory, and proxy/replication tier for authentication across enterprise applications. The affected 'OUD Core' component is the underlying directory engine that processes LDAP protocol operations (bind, search, add, modify). The attack vector is explicitly the LDAP protocol (typically TCP 389/1389 or LDAPS 636/1636). No CWE was assigned by Oracle or NVD, so the precise root-cause class is not documented; the 'takeover' language combined with full C/I/A impact suggests an authorization/access-control or injection-class weakness in LDAP request handling rather than pure information disclosure, despite the 'Information Disclosure' tag in the intelligence feed.

RemediationAI

Apply the fixes from the Oracle July 2026 Critical Patch Update (https://www.oracle.com/security-alerts/cpujul2026.html), which is the authoritative source for the exact patched build/CPU level for OUD 12.2.1.4.0 and 14.1.2.1.0 - Oracle CPUs deliver cumulative patches rather than a single new version string, so verify the applicable interim patch number against your installed release. Until patched, reduce exposure by restricting LDAP and LDAPS listener access (typically TCP 389/636/1389/1636) to trusted management networks and application tiers via firewall or ACL rules, and tighten OUD access control instructions (ACIs) and password policies to limit what low-privileged bind accounts can do, since PR:L is the exploitation prerequisite. Review and prune unnecessary authenticated directory accounts and enable detailed LDAP audit logging to detect anomalous operations; note that network restrictions may break legitimate remote directory clients and should be validated against your integration topology before enforcement.