What is the CVSS score of CVE-2026-60429?

CVE-2026-60429 has a CVSS 3.1 base score of 9.9 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Oracle Unified Directory are affected by CVE-2026-60429?

Oracle Unified Directory (OUD Core) versions 12.2.1.4.0 and 14.1.2.1.0 are vulnerable to complete compromise by low-privilege LDAP users with network access (CVSS 9.9), with no public exploit…

How to fix or mitigate CVE-2026-60429?

Within 24 hours: identify all systems running OUD 12.2.1.4.0 or 14.1.2.1.0 and isolate LDAP network segments using firewalls to block untrusted LDAP connections; enable verbose LDAP audit logging to detect anomalous access. Within 7 days: implement network segmentation restricting LDAP access to only authorized clients; disable or revoke low-privilege LDAP user accounts not essential for operations; audit all connected products for their reliance on this OUD instance. Within 30 days: monitor Oracle's Critical Patch Update channel for the fix and deploy immediately upon release; evaluate redundancy and failover architecture to reduce blast radius of future directory service compromises.

Oracle Unified Directory CVE-2026-60429

EUVD-2026-46827 CRITICAL

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-53qv-37c3-g85w

Authentication Bypass Oracle Unified Directory

9.9

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

9.9 CRITICAL

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

9.9 CRITICAL

Network LDAP reach with low-complexity, low-privilege bind (PR:L) and no user interaction; full C/I/A takeover with scope change to downstream products (S:C).

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 03:41 vuln.today

CVE Published

Jul 21, 2026 - 22:17 nvd

CRITICAL 9.9

DescriptionCVE.org

Vulnerability in the Oracle Unified Directory product of Oracle Fusion Middleware (component: OUD Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows low privileged attacker with network access via LDAP to compromise Oracle Unified Directory. While the vulnerability is in Oracle Unified Directory, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Unified Directory. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).

AnalysisAI

Full takeover of Oracle Unified Directory is possible in the OUD Core component of Oracle Fusion Middleware versions 12.2.1.4.0 and 14.1.2.1.0, where a low-privileged attacker with LDAP network access can compromise the directory service and, because of a scope change, significantly impact additional connected products. Oracle rates this CVSS 9.9 and lists it in the July 2026 Critical Patch Update; there is no public exploit identified at time of analysis and it is not on CISA KEV. The combination of low attack complexity, only low privileges required, and cross-product blast radius makes this one of the highest-severity fixes in the CPU.

Technical ContextAI

Oracle Unified Directory (OUD) is Oracle's all-in-one enterprise LDAP directory server, storage engine, proxy, and synchronization service used as an identity backbone within the Fusion Middleware stack. The flaw resides in the OUD Core component and is reached over the LDAP protocol (typically TCP 389/636 or the admin/replication ports), meaning any principal able to bind with low privileges can trigger it. Oracle did not assign a CWE (CWE: N/A) and does not disclose root-cause details in the CPU advisory, so the specific weakness class (e.g., improper authorization, injection, or access-control bypass) cannot be confirmed from available data; the 'Information Disclosure' tag and full C/I/A impact suggest an authorization or access-control failure leading to complete control. The scope change (S:C) indicates the vulnerable OUD component can affect resources beyond its own security authority - consistent with a directory server that brokers authentication for downstream applications.

RemediationAI

Apply the fixes delivered in the Oracle July 2026 Critical Patch Update (https://www.oracle.com/security-alerts/cpujul2026.html), which is the authoritative source for the exact patch/bundle numbers for OUD 12.2.1.4.0 and 14.1.2.1.0 - Patch available per vendor advisory; a discrete fixed build number was not included in the provided data, so confirm the specific patch ID against the CPU matrix before deployment. Until patching is complete, reduce exposure by restricting network reachability of OUD's LDAP/LDAPS and administration/replication ports to trusted management networks only (accepting that this may break remote clients or replication partners that legitimately need those ports), tightening and auditing low-privilege bind accounts since PR:L exploitation depends on holding some credential, and closely monitoring OUD logs for anomalous binds or operations. Because the vulnerability yields full takeover with scope change, treat any OUD instance exposed to broad or untrusted low-privilege access as the priority for the maintenance window.