What is the CVSS score of CVE-2026-60420?

CVE-2026-60420 has a CVSS 3.1 base score of 8.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N. EPSS exploitation probability: 0.3%.

Which versions of Oracle Unified Directory are affected by CVE-2026-60420?

A privilege escalation vulnerability in Oracle Unified Directory (versions 12.2.1.4.0 and 14.1.2.1.0) could allow an attacker to read and modify sensitive directory data, potentially exposing user…

How to fix or mitigate CVE-2026-60420?

Within 24 hours, inventory all systems running Oracle Unified Directory 12.2.1.4.0 or 14.1.2.1.0 and identify which applications and services depend on them for authentication or authorization. Within 7 days, implement firewall rules to restrict LDAP network access to only authorized clients, enable comprehensive audit logging of all directory queries, strengthen authentication controls on administrative accounts, and deploy monitoring alerts for suspicious data access patterns. Within 30 days, establish a patch readiness plan with Oracle, monitor security advisories for patch availability, and prepare infrastructure for rapid deployment once a vendor patch becomes available, targeting completion within 10 days of patch release.

Oracle Unified Directory CVE-2026-60420

EUVD-2026-46818 HIGH

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-vr2r-767c-q27f

Authentication Bypass Oracle Unified Directory

8.5

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.5 HIGH

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N

vuln.today AI

8.5 HIGH

Network LDAP with a low-privilege foothold and no user interaction gives AV:N/AC:L/PR:L/UI:N; directory authorization bypass affecting other products yields S:C with high confidentiality, partial integrity, and no availability impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 03:36 vuln.today

CVE Published

Jul 21, 2026 - 22:17 nvd

HIGH 8.5

DescriptionCVE.org

Vulnerability in the Oracle Unified Directory product of Oracle Fusion Middleware (component: OUD Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows low privileged attacker with network access via LDAP to compromise Oracle Unified Directory. While the vulnerability is in Oracle Unified Directory, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Unified Directory accessible data as well as unauthorized update, insert or delete access to some of Oracle Unified Directory accessible data. CVSS 3.1 Base Score 8.5 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N).

AnalysisAI

Privilege escalation and cross-product data compromise in Oracle Unified Directory 12.2.1.4.0 and 14.1.2.1.0 (OUD Core) lets a low-privileged network attacker abuse the LDAP interface to gain complete read access to all directory-accessible data and partial write access. Vendor-tagged as an authentication bypass with a scope change, meaning successful attacks can significantly impact other products that rely on this directory. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV, but the CVSS 3.1 base score of 8.5 with 'easily exploitable' vendor language marks it as a high-priority patch.

Technical ContextAI

Oracle Unified Directory (OUD) is Oracle's LDAPv3-compliant enterprise directory and storage service, part of Oracle Fusion Middleware, commonly used as an identity store, virtual directory, and proxy for authentication and user/group data. The vulnerability resides in the OUD Core component and is reached over the LDAP protocol (typically TCP 389/636). Oracle's tag classifies it as an Authentication Bypass; combined with the CVSS scope change (S:C), this indicates that a weakness in how OUD enforces access control or authorization on LDAP operations allows an already-authenticated low-privileged principal to read data beyond its authorization and affect systems outside OUD's own security scope. No CWE was assigned in the source data, but the behavior aligns with the improper-authorization / authentication-bypass class (CWE-285/CWE-287 family). Because directories like OUD back single-sign-on and downstream application authentication, a bypass here has blast radius beyond the directory itself.

RemediationAI

Apply the fixes from the Oracle Critical Patch Update of July 2026 (https://www.oracle.com/security-alerts/cpujul2026.html) to Oracle Unified Directory 12.2.1.4.0 and 14.1.2.1.0; Oracle distributes OUD security fixes as CPU bundle patches rather than as a discrete tagged version, so the exact patched build must be taken from the CPU advisory (patch available per vendor advisory - no standalone fix version number was provided in the input, do not assume one). Until patched, reduce exposure by network-restricting the LDAP/LDAPS listeners (389/636) so only trusted application hosts and administrators can reach OUD, since the attack is network-borne; this may break clients that connect from unexpected subnets. Tighten OUD access control instructions (ACIs) to enforce least privilege for low-privileged bind accounts, review and rotate any low-privilege service accounts that could serve as the required foothold, and enable/monitor LDAP audit logging for anomalous read/search or authorization-bypass patterns. These are compensating controls only - the CPU patch is the authoritative remediation.