What is the CVSS score of CVE-2026-60436?

CVE-2026-60436 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.3%.

Which versions of Oracle Unified Directory are affected by CVE-2026-60436?

Oracle Unified Directory (OUD Core), a critical enterprise authentication system, is vulnerable to remote denial-of-service attacks that disable directory services entirely.

How to fix or mitigate CVE-2026-60436?

Within 24 hours, identify all Oracle Unified Directory instances running versions 12.2.1.4.0 or 14.1.2.1.0 and immediately restrict LDAP network access via firewall rules to authorized internal applications and subnets only. Within 7 days, deploy comprehensive network segmentation blocking external connections to LDAP ports (389/TCP and 636/TCP), enable detailed access logging on all OUD instances, and establish baseline monitoring for abnormal connection patterns. Within 30 days, monitor Oracle's security advisories for patch availability, test patching procedures in a non-production environment, and prepare for immediate deployment once the vendor releases a fix.

Oracle Unified Directory CVE-2026-60436

EUVD-2026-46833 HIGH

Uncontrolled Resource Consumption (CWE-400)

2026-07-21 secalert_us@oracle.com

GHSA-3w8f-65wc-4gh4

Denial Of Service Oracle Unified Directory

7.5

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

7.5 HIGH

Unauthenticated LDAP request over the network (AV:N/AC:L/PR:N/UI:N) causes complete availability loss with no data impact, so C:N/I:N/A:H, scope unchanged.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 03:48 vuln.today

CVE Published

Jul 21, 2026 - 22:17 nvd

HIGH 7.5

DescriptionCVE.org

Vulnerability in the Oracle Unified Directory product of Oracle Fusion Middleware (component: OUD Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via LDAP to compromise Oracle Unified Directory. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Unified Directory. CVSS 3.1 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).

AnalysisAI

Denial of service in Oracle Unified Directory (OUD Core) versions 12.2.1.4.0 and 14.1.2.1.0 lets an unauthenticated attacker with LDAP network access hang or repeatedly crash the directory server, producing a complete availability outage. Oracle rates it CVSS 3.1 7.5 with availability-only impact and describes it as easily exploitable. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; confidentiality and integrity are unaffected.

Technical ContextAI

Oracle Unified Directory is Oracle's enterprise LDAP directory server and storage/proxy/synchronization component within Oracle Fusion Middleware, commonly deployed as an identity backbone for authentication and directory lookups. The flaw resides in OUD Core and is triggered over the LDAP protocol (typically TCP 389, or 636 for LDAPS), meaning malformed or abusive LDAP operations reach a code path that can be forced into an unrecoverable hang or repeatable crash. Oracle did not assign a CWE, but the behavior - an unauthenticated request causing complete service failure without touching stored data - is consistent with the Uncontrolled Resource Consumption / Improper Input Handling class (CWE-400 / CWE-20 family) affecting availability only.

RemediationAI

Apply the fixes delivered in the Oracle Critical Patch Update of July 2026 (https://www.oracle.com/security-alerts/cpujul2026.html) for the affected 12.2.1.4.0 and 14.1.2.1.0 branches; this is a vendor-released patch per the Oracle CPU, though an exact patched build number was not included in the provided data and should be taken from the CPU patch matrix. Until patching, reduce exposure by restricting LDAP/LDAPS access (TCP 389/636) to trusted management and application subnets via firewall or ACLs, and place OUD behind a network layer that filters untrusted LDAP traffic - noting the trade-off that overly broad blocking can break legitimate directory clients and downstream authentication. Consider rate-limiting or connection throttling in front of the LDAP listener and enabling monitoring with auto-restart of the OUD service to shorten outage duration, recognizing these mitigations reduce blast radius but do not remove the underlying crash condition.