What is the CVSS score of CVE-2026-60424?

CVE-2026-60424 has a CVSS 3.1 base score of 9.0 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Oracle Unified Directory are affected by CVE-2026-60424?

Oracle Unified Directory in Fusion Middleware versions 12.2.1.4.0 and 14.1.2.1.0 contains a critical remote vulnerability (CVSS 9.0) enabling complete compromise of the directory service and…

How to fix or mitigate CVE-2026-60424?

Within 24 hours: inventory all systems running affected OUD versions (12.2.1.4.0, 14.1.2.1.0) and audit which downstream applications depend on them for authentication or directory services. Begin isolating LDAP traffic at the network boundary using firewall rules. Within 7 days: implement network segmentation restricting LDAP access to only trusted application servers, disable LDAP on OUD instances not actively in use, and configure enhanced logging for all LDAP authentication attempts and errors. Contact Oracle support to confirm patch status and obtain a committed delivery timeline. Within 30 days: stage a test deployment of any released patch in a non-production environment, validate that dependent applications function correctly, and establish a rollback procedure before production patching.

Oracle Unified Directory CVE-2026-60424

EUVD-2026-46822 CRITICAL

Missing Authentication for Critical Function (CWE-306)

2026-07-21 secalert_us@oracle.com

GHSA-q2gx-f4f4-h6h9

Authentication Bypass Oracle Unified Directory

9.0

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

9.0 CRITICAL

AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

9.0 CRITICAL

Unauthenticated LDAP network reach (AV:N/PR:N) but Oracle-confirmed difficult exploitation (AC:H); directory takeover impacts trusting systems (S:C) with full C/I/A loss.

3.1 AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 03:38 vuln.today

CVE Published

Jul 21, 2026 - 22:17 nvd

CRITICAL 9.0

DescriptionCVE.org

Vulnerability in the Oracle Unified Directory product of Oracle Fusion Middleware (component: OUD Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via LDAP to compromise Oracle Unified Directory. While the vulnerability is in Oracle Unified Directory, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Unified Directory. CVSS 3.1 Base Score 9.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H).

AnalysisAI

Full compromise of Oracle Unified Directory is possible in the OUD Core component of Oracle Fusion Middleware versions 12.2.1.4.0 and 14.1.2.1.0, where a remote attacker interacting over LDAP can take over the directory service and impact other trusting systems due to a scope change. The flaw scores CVSS 9.0 but is rated high attack complexity (AC:H), meaning exploitation is difficult despite requiring no authentication. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Technical ContextAI

Oracle Unified Directory (OUD) is Oracle's enterprise LDAPv3 directory server and storage/proxy platform used for identity management within Oracle Fusion Middleware. The vulnerability resides in the OUD Core component and is reachable via the LDAP protocol, the primary interface OUD exposes for directory queries and modifications. Oracle does not publish a CWE for its Critical Patch Update entries (CWE: N/A in the input), so the precise root-cause class is not disclosed, but the CVSS scope change (S:C) indicates the vulnerable OUD process can affect resources beyond its own security authority - consistent with a directory server whose trust is relied upon by downstream applications for authentication and authorization decisions. The Oracle-applied tag 'Information Disclosure' is broader than the confirmed impact, which per the vector spans full confidentiality, integrity, and availability loss (C:H/I:H/A:H).

RemediationAI

Apply the fixes delivered in the Oracle Critical Patch Update of July 2026 (https://www.oracle.com/security-alerts/cpujul2026.html); Oracle distributes OUD security fixes through the CPU, so install the CPU-provided patch for your OUD release (12.2.1.4.0 or 14.1.2.1.0) - the input does not specify a discrete fixed build number beyond the CPU, so obtain the exact patch ID from the advisory rather than assuming a version string. As compensating controls until patching, restrict network reachability of the LDAP/LDAPS listeners to trusted management and application subnets via firewall or OUD access control (limits the unauthenticated network vector, at the cost of blocking legitimate remote clients that must be explicitly allowlisted), place OUD behind an LDAP proxy or terminate LDAPS to constrain exposure, and increase monitoring of anomalous LDAP operations against OUD given the scope-change takeover potential. Do not expose OUD LDAP ports directly to the internet.