Oracle Unified Directory CVE-2026-60437

Exploitation requires the attacker to already hold high privileges within Oracle Unified Directory (CVSS PR:H) and network access to the LDAP interface; there is no user interaction (UI:N) and low attack complexity (AC:L). The exact required feature or configuration is not disclosed beyond 'network access via LDAP' to the OUD Core component on supported versions 12.2.1.4.0 or 14.1.2.1.0. The primary limiting factor is the high-privilege prerequisite, which confines realistic exploitation to compromised administrative accounts, malicious insiders, or chained privilege escalation rather than anonymous remote attackers; exposure of the LDAP listener to the attacker's network is also required.

The CVSS 3.1 base score is 8.7 (High) with vector AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:H: network reachable, low complexity, no user interaction, but requiring high privileges (PR:H), with high integrity and availability impact and a scope change. Oracle labels it 'easily exploitable,' which aligns with AC:L. The strongest mitigating signal is PR:H - the attacker must already hold high privileges in the directory, so this is primarily an insider, compromised-admin, or privilege-abuse risk rather than a mass-exploitable unauthenticated flaw. No EPSS score, KEV listing, or POC was provided in the input, so real-world exploitation pressure appears low despite the high CVSS. No CWE and no independent technical detail beyond Oracle's advisory are available, so the exact mechanism cannot be verified. Net: a genuine high-impact issue for environments where OUD admin credentials could be abused, but not an internet-facing emergency given the high-privilege prerequisite and absence of any exploitation evidence.

An attacker who has obtained high-privilege OUD credentials (for example a compromised directory administrator or an abusive insider) connects to the LDAP interface over the network and issues crafted operations that modify or delete critical directory entries, then sends a repeatable request that hangs or crashes the service for a complete denial of service. Because of the scope change, the disruption cascades to dependent applications and products that rely on the directory for authentication and data. No public exploit code has been identified at time of analysis.