Oracle Unified Directory CVE-2026-60426

Exploitation requires network access to the Oracle Unified Directory LDAP interface and a valid low-privileged credential (CVSS PR:L, so this is an authenticated attack - the attacker must already be able to bind to the directory with at least a low-privilege account); no user interaction is needed (UI:N) and attack complexity is low (AC:L). It applies only to Oracle Unified Directory 12.2.1.4.0 and 14.1.2.1.0 running the OUD Core component. The primary limiting factor is the requirement for an existing low-privilege LDAP account, which prevents fully anonymous/unauthenticated exploitation; the primary amplifier is the scope change (S:C), meaning successful attacks can extend beyond OUD into products that trust it.

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N, score 8.5) indicates a network-reachable, low-complexity, no-user-interaction attack requiring only low privileges, with high confidentiality impact, low integrity impact, no availability impact, and a scope change - a strong profile for a directory service other products depend on. No EPSS score was provided in the input, and the CVE is not listed in CISA KEV, so there is no evidence of active exploitation; likewise no public POC was supplied, so exploitation is currently theoretical. The dominant risk driver is not exploit availability but blast radius: an attacker already holding any low-privilege LDAP credential could escalate to reading all directory data and partially tampering with it, and the scope change means downstream trust relationships are also at risk. This is a genuine priority for organizations running OUD as shared identity infrastructure, though the PR:L requirement (a valid low-privilege account is needed) meaningfully limits opportunistic mass exploitation compared to a fully unauthenticated flaw.

An attacker who has obtained any low-privileged LDAP account, such as a service or application bind credential, connects to the Oracle Unified Directory listener over the network and, exploiting the OUD Core flaw, escalates access to read all directory-stored data such as credentials, group memberships, and identity attributes, then makes limited unauthorized modifications. Because OUD is a scope-changing identity backbone, the attacker leverages that trust to impact additional Oracle products that rely on the directory. No public exploit code has been identified at time of analysis.