Oracle Unified Directory CVE-2026-60429

Exploitation requires network access to the Oracle Unified Directory service over the LDAP protocol and a low-privilege authenticated context (CVSS PR:L) - an anonymous, fully unauthenticated attack is NOT indicated by the vector, so the attacker must be able to bind with at least minimal credentials or reach an interface that grants low-privilege access. No user interaction is required (UI:N) and attack complexity is low (AC:L), and Oracle states the vulnerability is 'easily exploitable.' Affected deployments are limited to OUD Core in versions 12.2.1.4.0 and 14.1.2.1.0. The principal limiting factors are therefore the need for a valid low-privilege LDAP bind and network reachability of the OUD LDAP/admin ports; instances segmented away from untrusted networks and requiring strong authentication for any bind materially raise the bar for an attacker.

The signals point to a genuine high priority rather than an inflated score. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H = 9.9) shows network-reachable, low-complexity exploitation needing only low privileges and no user interaction, with total confidentiality, integrity, and availability loss and a scope change amplifying impact to other products. Oracle explicitly describes it as 'easily exploitable,' reinforcing the AC:L/low-effort assessment. No EPSS score, SSVC decision, or CWE was provided, and there is no POC or CISA KEV listing, so probability-of-exploitation and automatability cannot be quantified from the data - the risk case rests on CVSS plus Oracle's own 'easily exploitable' language. The one caveat: PR:L means the attacker needs some valid (even minimal) LDAP credential or bind capability, so fully anonymous exploitation is not indicated by the vector; environments that expose OUD to untrusted low-privilege accounts or the network face the greatest risk. Absence of KEV/POC lowers immediate mass-exploitation likelihood but does not reduce the patch urgency given the 9.9 rating and enterprise identity role.

An attacker who holds or obtains a low-privilege LDAP account (or reaches an OUD instance accepting low-privilege binds) sends a crafted LDAP request to the OUD Core component and, exploiting the flaw, escalates to full control of the directory server. From that takeover position the attacker manipulates identities and authentication decisions, and - due to the scope change - pivots to impact downstream Fusion Middleware applications that rely on OUD. No public POC has been identified, so this scenario is derived from the CVSS vector and Oracle's 'easily exploitable' characterization.