What is the CVSS score of CVE-2026-60423?

CVE-2026-60423 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Oracle Unified Directory are affected by CVE-2026-60423?

Oracle Unified Directory (OUD Core) versions 12.2.1.4.0 and 14.1.2.1.0 contain a significant vulnerability enabling complete compromise of the directory service through network-based LDAP…

How to fix or mitigate CVE-2026-60423?

Within 24 hours: identify and inventory all OUD Core instances in versions 12.2.1.4.0 or 14.1.2.1.0, assess which systems have network exposure to untrusted networks, and determine business continuity impact if directory service is compromised. Within 7 days: implement network segmentation to restrict LDAP protocol access to only authorized directory clients, deploy enhanced logging and alerting on affected directory systems to detect suspicious modifications and authentication anomalies, and harden administrative access with multi-factor authentication. Within 30 days: evaluate and plan upgrades to patched OUD versions once available from Oracle, maintain current backups of directory data on segregated infrastructure, and develop and test directory service failover and recovery procedures.

Oracle Unified Directory CVE-2026-60423

EUVD-2026-46821 HIGH

Improper Authentication (CWE-287)

2026-07-21 secalert_us@oracle.com

GHSA-wp32-3pcr-r6hw

Authentication Bypass Oracle Unified Directory

8.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network LDAP reach with a low-privilege bind gives AV:N/AC:L/PR:L/UI:N; full takeover justifies C:H/I:H/A:H, scope unchanged as impact stays within the directory.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 03:37 vuln.today

CVE Published

Jul 21, 2026 - 22:17 nvd

HIGH 8.8

DescriptionCVE.org

Vulnerability in the Oracle Unified Directory product of Oracle Fusion Middleware (component: OUD Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows low privileged attacker with network access via LDAP to compromise Oracle Unified Directory. Successful attacks of this vulnerability can result in takeover of Oracle Unified Directory. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Full compromise of Oracle Unified Directory (OUD Core) is possible when a low-privileged attacker with network access sends malicious traffic over LDAP, per the July 2026 Oracle Critical Patch Update. Affected supported releases are 12.2.1.4.0 and 14.1.2.1.0, and Oracle rates the flaw as easily exploitable with a CVSS 3.1 base score of 8.8, resulting in complete takeover of the directory service. No public exploit identified at time of analysis and the CVE is not on CISA KEV, but authenticated LDAP reachability makes it a strong patching priority for exposed directory servers.

Technical ContextAI

Oracle Unified Directory is Oracle's Java-based, all-in-one LDAPv3 directory service (directory server, proxy, and synchronization/virtualization) shipped as part of Oracle Fusion Middleware and commonly used as the identity store behind Fusion apps, WebLogic, and enterprise SSO. The flaw resides in the 'OUD Core' component and is reached through the LDAP protocol, the primary query/administration interface of the product, meaning any principal able to bind to the directory can drive the attack. No CWE was assigned in the source data, so the precise root-cause class (e.g., improper authorization, injection, or access-control bypass) is not disclosed; Oracle's own tag of 'Information Disclosure' understates the CVSS-declared full Confidentiality/Integrity/Availability impact and 'takeover' outcome, so the underlying weakness is best treated as a privilege/authorization defect in LDAP request handling rather than mere data leakage.

RemediationAI

Apply the fixes from the Oracle July 2026 Critical Patch Update (Patch available per vendor advisory: https://www.oracle.com/security-alerts/cpujul2026.html) to affected Oracle Unified Directory 12.2.1.4.0 and 14.1.2.1.0 instances; the input does not name a discrete fixed build number, so consult the CPU matrix for the exact patch/bundle for your release rather than assuming a version string. As compensating controls until patching, restrict network reachability of the LDAP/LDAPS listeners to trusted management and application subnets via firewall/ACLs (trade-off: application identity lookups must still traverse the allowlist), tighten and audit low-privilege bind accounts and remove unused service credentials since the attack requires only PR:L (trade-off: may disrupt integrations relying on shared low-priv binds), and increase monitoring/alerting on anomalous LDAP operations and admin-scope changes. Avoid exposing OUD directly to untrusted or internet-facing networks.