What is the CVSS score of CVE-2026-60425?

CVE-2026-60425 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.3%.

Which versions of Oracle Unified Directory are affected by CVE-2026-60425?

Oracle Unified Directory (OUD) versions 12.2.1.4.0 and 14.1.2.1.0 contain a remote denial-of-service vulnerability allowing unauthenticated attackers to crash the directory service and disrupt all…

How to fix or mitigate CVE-2026-60425?

Within 24 hours, audit all Oracle Unified Directory deployments to identify affected versions (12.2.1.4.0 and 14.1.2.1.0) and restrict network access to OUD services to trusted administrative networks only via firewall rules. Within 7 days, apply the Oracle Critical Patch Update from July 2026 across all affected instances during a planned maintenance window. Within 30 days, complete post-deployment validation and document patching completion in your change management and compliance systems.

Oracle Unified Directory CVE-2026-60425

EUVD-2026-46823 HIGH

Uncontrolled Resource Consumption (CWE-400)

2026-07-21 secalert_us@oracle.com

GHSA-r2wr-fr6p-92wf

Denial Of Service Oracle Unified Directory

7.5

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

7.5 HIGH

Unauthenticated network LDAP request (AV:N/AC:L/PR:N/UI:N) causes a repeatable full crash with no data impact, so C:N/I:N and A:H.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 03:38 vuln.today

CVE Published

Jul 21, 2026 - 22:17 nvd

HIGH 7.5

DescriptionCVE.org

Vulnerability in the Oracle Unified Directory product of Oracle Fusion Middleware (component: OUD Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via LDAP to compromise Oracle Unified Directory. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Unified Directory. CVSS 3.1 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).

AnalysisAI

Remote denial-of-service in Oracle Unified Directory (OUD Core) 12.2.1.4.0 and 14.1.2.1.0 lets an unauthenticated network attacker send crafted LDAP traffic that hangs or repeatedly crashes the directory service, producing a complete availability outage. Addressed in the Oracle Critical Patch Update of July 2026, the flaw carries CVSS 7.5 (availability-only) with no impact to confidentiality or integrity. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, so exploitation is currently theoretical rather than observed.

Technical ContextAI

Oracle Unified Directory is Oracle's Java-based LDAPv3 directory server and directory proxy, shipped within the Oracle Fusion Middleware stack and commonly used as an enterprise identity/authentication backend and as a consolidation point for user, group, and policy data. The vulnerability lives in the OUD Core component, meaning it sits in the server's core LDAP request-handling path rather than a peripheral add-on. The affected versions span the long-term 12.2.1.4.0 release train and the newer 14.1.2.1.0 release. No CWE was assigned in the source data, but the observable behavior - an unauthenticated LDAP request causing a hang or repeatable crash with no data disclosure or modification - is consistent with an uncaught-exception, resource-exhaustion, or reachable-assertion class of defect (CWE-248/CWE-400/CWE-617 family) in the LDAP protocol parser or connection handler. The CVSS availability-only profile (C:N/I:N/A:H) reinforces that the defect corrupts service continuity rather than the underlying directory data.

RemediationAI

Apply the fixes delivered in the Oracle Critical Patch Update of July 2026 (Patch available per vendor advisory) referenced at https://www.oracle.com/security-alerts/cpujul2026.html; the input does not specify an exact patched build number, so administrators should pull the CPU July 2026 patch corresponding to their 12.2.1.4.0 or 14.1.2.1.0 installation rather than relying on an invented version. Until patching completes, reduce exposure with compensating controls: restrict OUD's LDAP/LDAPS listener (typically TCP 389/636 and any admin/replication ports) to trusted management and application subnets via firewall or network ACLs so untrusted clients cannot reach the parser - the trade-off is that any legitimate client outside those ranges will lose connectivity and must be explicitly allowed. Place OUD behind a directory proxy or load balancer that can rate-limit and drop malformed LDAP connections, accepting the added latency and operational complexity. Enable monitoring and automatic service restart/watchdog on the OUD process to shorten outage duration if a crash is triggered, recognizing this mitigates symptom, not cause. Because impact is availability-only, no data-loss or credential-rotation response is required, but restoring service after a crash and confirming replication health remain priorities.