What is the CVSS score of CVE-2026-60428?

CVE-2026-60428 has a CVSS 3.1 base score of 8.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N. EPSS exploitation probability: 0.3%.

Which versions of Unified Directory are affected by CVE-2026-60428?

Oracle Unified Directory (OUD) versions 12.2.1.4.0 and 14.1.2.1.0 contain a critical authentication bypass (CVSS 8.2) that allows unauthenticated remote attackers to read sensitive directory data,…

How to fix or mitigate CVE-2026-60428?

Within 24 hours: inventory all systems running Oracle Unified Directory 12.2.1.4.0 or 14.1.2.1.0 and document their network exposure; restrict LDAP ports (389/TCP and 636/TCP) to authorized internal systems only via firewall rules; enable LDAP audit logging at maximum verbosity. Within 7 days: implement network segmentation to isolate OUD instances from untrusted networks and the internet; analyze LDAP query logs for suspicious patterns or unauthorized access; assess whether unauthorized directory access has already occurred. Within 30 days: establish a relationship with Oracle support to track patch availability timelines; evaluate and test upgrade paths to patched OUD versions; deploy an LDAP proxy or gateway requiring additional authentication validation before reaching the directory; implement directory-level access controls restricting sensitive attributes to authenticated principals.

Unified Directory CVE-2026-60428

EUVD-2026-46826 HIGH

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-mfcj-77px-whw5

Authentication Bypass Oracle Unified Directory

8.2

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.2 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Primary rating from Vendor (oracle) · only source for this CVE.

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 03:40 vuln.today

CVE Published

Jul 21, 2026 - 22:17 nvd

HIGH 8.2

DescriptionCVE.org

Vulnerability in the Oracle Unified Directory product of Oracle Fusion Middleware (component: OUD Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via LDAP to compromise Oracle Unified Directory. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Unified Directory accessible data as well as unauthorized update, insert or delete access to some of Oracle Unified Directory accessible data. CVSS 3.1 Base Score 8.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N).

AnalysisAI

Unauthorized data access in Oracle Unified Directory 12.2.1.4.0 and 14.1.2.1.0 (OUD Core component) lets a remote unauthenticated attacker abuse the LDAP interface to read critical directory data and make limited unauthorized modifications. Rated CVSS 8.2 and flagged by Oracle as easily exploitable, the flaw is tagged as an authentication bypass, meaning directory contents can be reached without valid credentials. No public exploit identified at time of analysis, and it is not listed in CISA KEV.