Oracle Unified Directory CVE-2026-60424

Exploitation requires network access to an Oracle Unified Directory instance via the LDAP protocol (the OUD Core component) on affected versions 12.2.1.4.0 or 14.1.2.1.0; no authentication (PR:N) and no user interaction (UI:N) are needed. The limiting factor is high attack complexity (AC:H) - Oracle explicitly labels this 'difficult to exploit,' indicating conditions outside the attacker's direct control (such as specific timing, server state, or configuration) must hold for success, which meaningfully reduces realistic exploitability despite the unauthenticated reach. Exposure is further limited to environments where the OUD LDAP listener is reachable by the attacker.

The signals are mixed and warrant careful triage. CVSS 9.0 (Critical) is driven by an unauthenticated network vector (AV:N/PR:N/UI:N), a scope change (S:C), and full CIA impact - but is tempered by high attack complexity (AC:H), which Oracle further characterizes as 'difficult to exploit,' implying special conditions, timing, or non-deterministic prerequisites the attacker cannot fully control. No EPSS score is provided, so exploitation probability cannot be quantified from the data. There is no CISA KEV listing and no public exploit identified, so despite the critical score this is not currently evidence of active or widespread exploitation. The realistic near-term risk is moderate-to-high for internet- or partner-exposed OUD instances given the unauthenticated reach, but the AC:H barrier makes opportunistic mass exploitation less likely than the raw score suggests. Note the tension: Oracle's 'Information Disclosure' tag understates the vector's full C/I/A and takeover impact - treat the CVSS vector, not the tag, as authoritative.

An attacker with network reachability to an OUD LDAP/LDAPS listener submits specially crafted directory protocol interactions that exploit the OUD Core flaw, and after satisfying the difficult-to-trigger conditions gains control of the directory server. Because of the scope change, the attacker leverages the compromised directory's trust to affect downstream applications that rely on OUD for identity and authorization. No public proof-of-concept exists at time of analysis, and the high attack complexity means the attacker likely needs favorable conditions or repeated attempts.