What is the CVSS score of CVE-2026-60430?

CVE-2026-60430 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Oracle Unified Directory are affected by CVE-2026-60430?

Oracle Unified Directory (OUD) instances in versions 12.2.1.4.0 and 14.1.2.1.0 face complete remote compromise through low-privilege attacks on network-accessible LDAP interfaces, creating elevated…

How to fix or mitigate CVE-2026-60430?

Within 24 hours, inventory all production and non-production instances of Oracle Unified Directory versions 12.2.1.4.0 and 14.1.2.1.0 and assess their network exposure to untrusted clients. Within 7 days, implement network segmentation to restrict LDAP traffic to affected OUD servers (internal networks and authorized administrative access only), enable detailed audit logging for all LDAP operations and authentication attempts, and establish continuous monitoring for anomalous LDAP query patterns. Within 30 days, establish a formal patch-staging process to immediately test and deploy OUD updates upon Oracle release, evaluate supplementary or backup directory services to reduce single-point-of-failure exposure during the vulnerability window, and conduct incident response exercises for directory compromise scenarios.

Oracle Unified Directory CVE-2026-60430

EUVD-2026-46828 HIGH

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-xgpw-2j8q-7j56

Authentication Bypass Oracle Unified Directory

8.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network LDAP interface (AV:N) with vendor-stated low complexity (AC:L) requires an authenticated low-privilege bind (PR:L), no user interaction, and yields full takeover, so C/I/A all High.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 03:41 vuln.today

CVE Published

Jul 21, 2026 - 22:17 nvd

HIGH 8.8

DescriptionCVE.org

Vulnerability in the Oracle Unified Directory product of Oracle Fusion Middleware (component: OUD Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows low privileged attacker with network access via LDAP to compromise Oracle Unified Directory. Successful attacks of this vulnerability can result in takeover of Oracle Unified Directory. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Full compromise of Oracle Unified Directory (OUD Core component of Oracle Fusion Middleware) is possible when a low-privileged attacker sends malicious traffic over LDAP to affected versions 12.2.1.4.0 and 14.1.2.1.0. Oracle rates this 8.8 (CVSS 3.1) and characterizes it as 'easily exploitable,' with successful attacks resulting in complete takeover of the directory server, breaching confidentiality, integrity, and availability. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and network-facing LDAP interface make it a high-priority patch item.

Technical ContextAI

Oracle Unified Directory (OUD) is Oracle's enterprise LDAP directory and virtual directory server, part of the Fusion Middleware stack and frequently used as an identity store backing enterprise authentication, single sign-on, and provisioning. The vulnerable OUD Core component is the engine that handles LDAP protocol operations (bind, search, modify), so the attack surface is the network-exposed LDAP/LDAPS listener. Oracle did not assign a CWE (CWE: N/A) and does not disclose root-cause details in its Critical Patch Update format, so the specific weakness class (e.g. authorization bypass, injection, or logic flaw in LDAP operation handling) cannot be determined from available data; the CVSS profile (low privilege, no user interaction, full CIA impact, unchanged scope) is consistent with an authenticated LDAP operation being abused to escalate to control of the directory.

RemediationAI

Apply the fixes delivered in the Oracle Critical Patch Update of July 2026 (https://www.oracle.com/security-alerts/cpujul2026.html) - Patch available per vendor advisory; consult the CPU matrix for the exact patch/bundle applicable to Oracle Unified Directory 12.2.1.4.0 and 14.1.2.1.0, as Oracle distributes fixes via CPU bundle patches rather than a single named release version, and no independently confirmed fixed version string is available in the input. Until patching is complete, reduce exposure by restricting network reachability of the LDAP/LDAPS listeners to trusted management and application subnets via firewall or network ACLs (side effect: legitimate clients on untrusted networks lose connectivity and must be whitelisted), tightening which accounts hold low-privilege LDAP bind rights since PR:L is a prerequisite, and increasing monitoring/audit logging of LDAP operations to detect anomalous modify or search activity. These are compensating controls only; because full takeover is possible, the vendor patch should be prioritized.