Oracle Unified Directory CVE-2026-60423

Exploitation requires network reachability to the Oracle Unified Directory LDAP interface and a low-privileged authenticated bind (CVSS PR:L) - it is NOT unauthenticated: the attacker needs at least a low-privilege directory credential or account. No user interaction is required (UI:N) and attack complexity is low (AC:L), and Oracle confirms the vector is specifically LDAP against the OUD Core component. Limiting factors that reduce real-world risk: the attacker must already possess a valid low-privilege LDAP account, and the LDAP listener must be reachable from the attacker's network position; environments that segment OUD to trusted subnets and tightly control bind accounts materially raise the bar. Affected deployments are limited to supported versions 12.2.1.4.0 and 14.1.2.1.0.

The signals point to a genuine priority rather than an inflated high score. The CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (8.8, High) shows network-based, low-complexity, no-user-interaction exploitation requiring only low privileges, with full C/I/A impact - Oracle explicitly calls it 'easily exploitable' and the outcome 'takeover.' No EPSS score, SSVC decision, or CWE was provided in the input, so automatability and exploitation-probability signals cannot be quantified here. There is no CISA KEV listing and no public POC in the data (no public exploit identified at time of analysis), so this is not confirmed active exploitation; however, the low bar to exploit (any low-privileged LDAP account) combined with directory servers' central role in identity infrastructure means realistic risk is high wherever OUD is network-reachable. One caveat: Oracle's 'Information Disclosure' tag conflicts with the CVSS full-integrity/availability impact and 'takeover' language - the CVSS metrics should be treated as authoritative over the tag.

An attacker who holds or obtains any low-privileged directory account connects to the OUD LDAP listener over the network and issues crafted LDAP operations against the OUD Core component, with no user interaction and low attack complexity. The operation abuses the flaw to escalate to full control, resulting in complete takeover of the directory - including reading, modifying, or destroying identity data. No public exploit is identified at time of analysis, so this scenario is inferred from the CVSS vector and Oracle's 'easily exploitable / takeover' description.