What is the CVSS score of CVE-2026-60422?

CVE-2026-60422 has a CVSS 3.1 base score of 9.9 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L. EPSS exploitation probability: 0.3%.

Which versions of Unified Directory are affected by CVE-2026-60422?

Oracle Unified Directory 14.1.2.1.0 exposes organizations to complete data compromise through a critical privilege escalation vulnerability affecting any authenticated LDAP user.

How to fix or mitigate CVE-2026-60422?

Within 24 hours: immediately restrict OUD LDAP network access to trusted administrative networks via firewall rules, enable comprehensive logging of all directory modifications and queries, and audit current low-privilege account permissions for removal of unnecessary directory access. Within 7 days: implement LDAP binding restrictions limiting directory access to essential applications only, deploy alerting on suspicious account creation or privilege modifications, and conduct forensic review of directory logs for unauthorized changes or anomalies. Within 30 days: continuously monitor Oracle security advisories for patch availability; concurrently develop and test a contingency migration plan to an alternative directory platform (such as Active Directory or FreeIPA) with parallel deployment capability if no patch is released within 60 days.

Unified Directory CVE-2026-60422

EUVD-2026-46820 CRITICAL

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-r9q8-hj9f-3v76

Authentication Bypass Denial Of Service Oracle Unified Directory

9.9

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

9.9 CRITICAL

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L

Primary rating from Vendor (oracle) · only source for this CVE.

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 03:37 vuln.today

CVE Published

Jul 21, 2026 - 22:17 nvd

CRITICAL 9.9

DescriptionCVE.org

Vulnerability in the Oracle Unified Directory product of Oracle Fusion Middleware (component: OUD Core). The supported version that is affected is 14.1.2.1.0. Easily exploitable vulnerability allows low privileged attacker with network access via LDAP to compromise Oracle Unified Directory. While the vulnerability is in Oracle Unified Directory, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Unified Directory accessible data as well as unauthorized access to critical data or complete access to all Oracle Unified Directory accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Unified Directory. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L).

AnalysisAI

Privilege escalation and data compromise in Oracle Unified Directory 14.1.2.1.0 (OUD Core) lets a low-privileged, authenticated attacker with LDAP network access read, create, modify or delete all OUD-accessible data and cause a partial denial of service. Oracle rates it CVSS 9.9 with a scope change, meaning exploitation can significantly impact additional products beyond the directory itself. No public exploit identified at time of analysis and it is not listed in CISA KEV, but the near-maximum score and low attack complexity make it a top patching priority.