Oracle Unified Directory CVE-2026-60425

The only prerequisite is network reachability to the Oracle Unified Directory LDAP service (versions 12.2.1.4.0 or 14.1.2.1.0, OUD Core component); the CVSS vector AV:N/AC:L/PR:N/UI:N confirms no authentication, no user interaction, and low complexity against default OUD deployments. What limits exploitation is exposure, not configuration: the attacker must be able to open an LDAP/LDAPS connection to the server, so instances confined to segmented internal networks or firewalled to trusted client subnets are not reachable by external attackers. Impact is bounded to availability (A:H, C:N/I:N) - successful exploitation causes a hang or repeatable full crash (complete DOS) but yields no data access or code execution.

The signals are internally consistent and point to a genuine but bounded risk. The Oracle-supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5) describes an easily exploitable, unauthenticated, network-reachable condition with no user interaction - attributes that make it attractive for opportunistic disruption. However, impact is confined to availability: there is no path to data theft, tampering, or code execution, so this is a service-outage risk, not a breach risk. No EPSS score, POC, or KEV entry was provided, so there is no evidence of active exploitation or automated weaponization; exploitation status is 'no public exploit identified at time of analysis.' There is no conflict between the description and the CVSS vector - both agree on unauthenticated LDAP network access. The practical priority therefore scales with exposure: OUD instances whose LDAP port is reachable from untrusted networks warrant prompt patching because a single crafted request can take down authentication for every downstream application; internal-only, network-segmented deployments face materially lower real-world risk. No EPSS data is available to quantify near-term exploitation probability - treat this as a patch-on-cycle item elevated to urgent where OUD is internet- or DMZ-facing.

An attacker who can reach an OUD instance's LDAP port over the network sends a crafted, malformed, or specifically-structured LDAP request without needing any credentials, causing the OUD Core request handler to hang or crash. Because the fault is repeatable, the attacker can loop the request to keep the directory offline, breaking authentication and lookups for every application that depends on it. No public POC is identified at time of analysis, but the low attack complexity (AC:L) and lack of authentication (PR:N) make weaponization straightforward if the flaw becomes public.