What is the CVSS score of CVE-2026-60426?

CVE-2026-60426 has a CVSS 3.1 base score of 8.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N. EPSS exploitation probability: 0.2%.

Which versions of Oracle Unified Directory are affected by CVE-2026-60426?

Oracle Unified Directory (OUD) versions 12.2.1.4.0 and 14.1.2.1.0 contain a privilege escalation vulnerability (CVSS 8.5) that allows low-privileged attackers with LDAP access to read sensitive…

How to fix or mitigate CVE-2026-60426?

Within 24 hours: Audit network access logs and inventory all systems with LDAP connectivity to OUD 12.2.1.4.0 and 14.1.2.1.0, documenting all dependent applications and services. Within 7 days: Implement firewall rules and network segmentation to restrict LDAP access to OUD to only necessary systems, disable or revoke unnecessary low-privileged LDAP accounts, and enable detailed monitoring and alerting for OUD authentication failures and directory modifications. Within 30 days: Monitor Oracle's Critical Patch Update (CPU) schedule for an official fix, engage Oracle Support for upgrade path guidance, and evaluate feasibility of upgrading to newer OUD versions or migrating to alternative identity management platforms.

Oracle Unified Directory CVE-2026-60426

EUVD-2026-46824 HIGH

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-j2p4-hr6w-pqmq

Authentication Bypass Oracle Unified Directory

8.5

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.5 HIGH

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N

vuln.today AI

8.5 HIGH

Network LDAP reach with low complexity and a required low-privilege bind gives AV:N/AC:L/PR:L; scope change plus high read, low write, no availability yields S:C/C:H/I:L/A:N.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 03:39 vuln.today

CVE Published

Jul 21, 2026 - 22:17 nvd

HIGH 8.5

DescriptionCVE.org

Vulnerability in the Oracle Unified Directory product of Oracle Fusion Middleware (component: OUD Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows low privileged attacker with network access via LDAP to compromise Oracle Unified Directory. While the vulnerability is in Oracle Unified Directory, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Unified Directory accessible data as well as unauthorized update, insert or delete access to some of Oracle Unified Directory accessible data. CVSS 3.1 Base Score 8.5 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N).

AnalysisAI

Elevation-of-scope compromise in Oracle Unified Directory (Fusion Middleware, OUD Core component) versions 12.2.1.4.0 and 14.1.2.1.0 lets an authenticated low-privileged attacker with LDAP network access read all OUD-accessible data and modify some of it, with a scope change that can significantly impact additional connected products. Oracle rates it CVSS 3.1 8.5, and the source intelligence tags it as an authentication-bypass-class issue. There is no public exploit identified at time of analysis and it is not in CISA KEV, but the low attack complexity and scope change make it a meaningful patch priority for Oracle-integrated identity infrastructure.

Technical ContextAI

Oracle Unified Directory is Oracle's LDAPv3-compliant, all-in-one directory service (directory server, proxy, virtual directory, and storage/synchronization) shipped as part of Oracle Fusion Middleware and frequently used as a central identity store fronting products such as Oracle Access Manager and Fusion Applications. The flaw resides in the OUD Core component and is reached over the LDAP protocol. No CWE was assigned by NVD (CWE: N/A), but the source-provided 'Authentication Bypass' tag combined with the confidentiality-and-integrity impact profile points to a flaw in access-control or identity-enforcement logic within the directory engine rather than a memory-safety bug. Because OUD acts as a shared identity backbone, the CVSS scope change (S:C) reflects that a directory compromise can cascade into downstream products that trust it for authentication and authorization data.

RemediationAI

Apply the fixes delivered in the Oracle Critical Patch Update of July 2026 (patch available per Oracle CPU advisory: https://www.oracle.com/security-alerts/cpujul2026.html) for the affected Oracle Unified Directory 12.2.1.4.0 and 14.1.2.1.0 releases; an exact fixed build number was not provided in the input, so consult the CPU patch matrix for the correct patch for your version. Until patching is complete, reduce exposure by restricting network access to the OUD LDAP/LDAPS listener so that only trusted application hosts and administrators can reach it via network ACLs or firewall rules, accepting that this may break clients connecting from unexpected hosts. Additionally, tighten and audit low-privilege directory accounts and rotate any credentials that could serve as the required foothold, and increase monitoring of LDAP bind, search, and modify activity for anomalous patterns; these controls raise the bar but do not substitute for the vendor patch given the scope-change impact on downstream products.