What is the CVSS score of CVE-2026-60421?

CVE-2026-60421 has a CVSS 3.1 base score of 8.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N. EPSS exploitation probability: 0.2%.

Which versions of Unified Directory are affected by CVE-2026-60421?

Oracle Unified Directory (OUD Core) versions 12.2.1.4.0 and 14.1.2.1.0 contain a privilege-escalation vulnerability that allows authenticated LDAP users to read and modify directory data beyond their…

How to fix or mitigate CVE-2026-60421?

Within 24 hours, conduct an immediate inventory of all Oracle Unified Directory (OUD Core) instances running versions 12.2.1.4.0 or 14.1.2.1.0 and document all applications and systems that depend on these instances for authentication or authorization services. Restrict network access to affected OUD systems to only critical service accounts and applications through firewall and network segmentation if necessary. Within 7 days, enable comprehensive audit logging on all affected OUD instances to capture all directory read and modification operations, deploy monitoring to detect privilege escalation attempts, and baseline expected LDAP access patterns to identify anomalies. Implement principle of least privilege on all LDAP service accounts, reducing directory permissions to minimum necessary scopes. Within 30 days, contact Oracle to determine patch availability and timelines for versions 12.2.1.4.0 and 14.1.2.1.0, conduct a full audit of directory data to identify unauthorized modifications, and develop a migration plan to upgrade or replace affected OUD instances with patched versions, prioritizing systems with access to sensitive identity data.

Unified Directory CVE-2026-60421

EUVD-2026-46819 HIGH

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-9cjh-wwxc-9gq2

Authentication Bypass Oracle Unified Directory

8.2

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.2 HIGH

AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N

Primary rating from Vendor (oracle) · only source for this CVE.

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 03:37 vuln.today

CVE Published

Jul 21, 2026 - 22:17 nvd

HIGH 8.2

DescriptionCVE.org

Vulnerability in the Oracle Unified Directory product of Oracle Fusion Middleware (component: OUD Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Difficult to exploit vulnerability allows low privileged attacker with network access via LDAP to compromise Oracle Unified Directory. While the vulnerability is in Oracle Unified Directory, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Unified Directory accessible data as well as unauthorized access to critical data or complete access to all Oracle Unified Directory accessible data. CVSS 3.1 Base Score 8.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N).

AnalysisAI

Privilege-scoped data compromise in Oracle Unified Directory (OUD Core) 12.2.1.4.0 and 14.1.2.1.0 lets a low-privileged, authenticated attacker with LDAP network access read and modify all directory-accessible data, with a scope change that can significantly impact other integrated products. Rated CVSS 3.1 8.2 (C:H/I:H, no availability impact) and tagged as an authentication-bypass class issue, though the attack is rated hard to execute (AC:H). No public exploit identified at time of analysis and it is not on CISA KEV.