What is the CVSS score of CVE-2026-60427?

CVE-2026-60427 has a CVSS 3.1 base score of 8.7 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N. EPSS exploitation probability: 0.3%.

Which versions of Oracle Unified Directory are affected by CVE-2026-60427?

Oracle Unified Directory (OUD Core) versions 12.2.1.4.0 and 14.1.2.1.0 contain a remote authentication bypass allowing unauthenticated attackers to read and modify all identity data stored in the…

How to fix or mitigate CVE-2026-60427?

Within 24 hours, identify all OUD Core instances running versions 12.2.1.4.0 or 14.1.2.1.0 and determine their business criticality and downstream system dependencies. Within 7 days, apply the Oracle July 2026 Critical Patch Update to test environments first to validate Fusion Middleware compatibility, then immediately to critical production systems. By day 30, complete patching of all remaining affected production systems and execute vulnerability scanning to confirm successful remediation.

Oracle Unified Directory CVE-2026-60427

EUVD-2026-46825 HIGH

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-9c8f-gpwh-9j35

Authentication Bypass Oracle Unified Directory

8.7

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.7 HIGH

AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N

vuln.today AI

8.7 HIGH

Unauthenticated LDAP-reachable bypass (AV:N/PR:N) that Oracle rates difficult (AC:H), with directory data read/modify and cross-product scope change (S:C/C:H/I:H) but no availability impact.

3.1 AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 03:39 vuln.today

CVE Published

Jul 21, 2026 - 22:17 nvd

HIGH 8.7

DescriptionCVE.org

Vulnerability in the Oracle Unified Directory product of Oracle Fusion Middleware (component: OUD Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via LDAP to compromise Oracle Unified Directory. While the vulnerability is in Oracle Unified Directory, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Unified Directory accessible data as well as unauthorized access to critical data or complete access to all Oracle Unified Directory accessible data. CVSS 3.1 Base Score 8.7 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N).

AnalysisAI

Scope-changing compromise of Oracle Unified Directory (OUD Core) 12.2.1.4.0 and 14.1.2.1.0 lets a remote, unauthenticated attacker abuse the LDAP interface to read and alter all directory-accessible data, tagged by Oracle as an authentication bypass. Because OUD brokers identity and access for downstream Fusion Middleware systems, successful attacks carry a CVSS 3.1 scope change (S:C) and can significantly impact other products beyond the directory itself. No public exploit identified at time of analysis; exploitation is rated high-complexity (AC:H), so this is a serious but non-trivial-to-weaponize flaw addressed in Oracle's July 2026 Critical Patch Update.

Technical ContextAI

Oracle Unified Directory is Oracle's Java-based LDAPv3 directory server and directory proxy, used as the central identity store and virtual directory for Oracle Fusion Middleware and Identity Management stacks. The vulnerability sits in the OUD Core component and is reachable over the LDAP protocol (the service's primary network-facing interface), meaning any client able to open an LDAP/LDAPS connection can attempt exploitation without credentials. Oracle's own tag characterizes this as an Authentication Bypass, implying the LDAP request-handling or bind/authorization path can be manipulated to grant access it should not; the confidentiality and integrity impact (C:H/I:H) with no availability impact indicates data disclosure and unauthorized modification rather than service disruption. No CWE was assigned by NVD, so the precise weakness class (e.g., improper authentication or access-control bypass) is inferred from Oracle's tag rather than confirmed by a mapped CWE.

RemediationAI

Apply the fixes delivered in Oracle's July 2026 Critical Patch Update (https://www.oracle.com/security-alerts/cpujul2026.html) to the affected Oracle Unified Directory 12.2.1.4.0 and 14.1.2.1.0 deployments - Patch available per vendor advisory, though a specific standalone fixed build number is not enumerated in the supplied data and should be taken from the CPU patch matrix for your version. Until patching completes, reduce exposure of the LDAP listener: restrict network access to the OUD LDAP/LDAPS ports so only trusted application hosts and administrative subnets can connect (via firewall or network ACLs), which limits reachability of the vulnerable interface at the cost of breaking any clients that were connecting from now-blocked networks. Enforce LDAPS/TLS and, where supported, connection-source allowlisting on the directory, and increase monitoring of OUD access and change logs for anomalous binds or unexpected create/delete/modify operations, accepting the added log-review overhead. Because this is a scope-changing flaw affecting dependent products, also review and monitor the downstream Fusion Middleware systems that trust this directory for identity.