What is the CVSS score of CVE-2026-60437?

CVE-2026-60437 has a CVSS 3.1 base score of 8.7 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Oracle Unified Directory are affected by CVE-2026-60437?

Oracle Unified Directory versions 12.2.1.4.0 and 14.1.2.1.0 contain a critical vulnerability enabling high-privileged network attackers to corrupt directory data and crash the service, with impact…

How to fix or mitigate CVE-2026-60437?

Within 24 hours, inventory all deployments of Oracle Unified Directory 12.2.1.4.0 and 14.1.2.1.0 and restrict LDAP network access to essential administrative hosts only. Within 7 days, apply patches from the Oracle July 2026 Critical Patch Update for all affected instances and validate directory data integrity post-patch. Within 30 days, complete patch deployment to all redundant and replicated OUD instances, enable comprehensive audit logging for directory modifications, and conduct a security review of LDAP access controls and high-privilege account usage.

Oracle Unified Directory CVE-2026-60437

EUVD-2026-46834 HIGH

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-7pgx-x96w-26mc

Authentication Bypass Oracle Unified Directory

8.7

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.7 HIGH

AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:H

vuln.today AI

8.7 HIGH

LDAP is network-reachable (AV:N) and easily exploitable (AC:L) but needs existing high directory privileges (PR:H); high integrity/availability impact with a scope change and no confidentiality loss (C:N).

3.1 AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:H/SC:N/SI:H/SA:H

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

None

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 03:49 vuln.today

CVE Published

Jul 21, 2026 - 22:17 nvd

HIGH 8.7

DescriptionCVE.org

Vulnerability in the Oracle Unified Directory product of Oracle Fusion Middleware (component: OUD Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows high privileged attacker with network access via LDAP to compromise Oracle Unified Directory. While the vulnerability is in Oracle Unified Directory, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Unified Directory accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Unified Directory. CVSS 3.1 Base Score 8.7 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:H).

AnalysisAI

Data tampering and denial-of-service in Oracle Unified Directory (OUD Core component) let a high-privileged, network-adjacent attacker abuse the LDAP interface to modify or destroy directory data and force a complete crash or hang of the service. Affected supported versions are 12.2.1.4.0 and 14.1.2.1.0, addressed in the Oracle July 2026 Critical Patch Update. The flaw carries a scope change, meaning a successful attack can significantly impact products beyond OUD itself. No public exploit has been identified at time of analysis.

Technical ContextAI

Oracle Unified Directory is Oracle Fusion Middleware's all-in-one LDAPv3 directory server, proxy, and synchronization/storage service used as an enterprise identity store. The defect lives in the OUD Core component and is reached over the LDAP protocol (typically TCP 389/636/1389). Oracle did not assign a specific CWE (CWE: N/A), but the described effects - unauthorized creation, deletion, or modification of critical data and a repeatable crash/hang causing complete denial of service - are consistent with an authorization or input-handling weakness in LDAP request processing that also crosses a trust boundary (CVSS scope change), allowing impact on downstream or co-located components that rely on the directory for identity data.

RemediationAI

Apply the fixes delivered in the Oracle July 2026 Critical Patch Update for Oracle Unified Directory 12.2.1.4.0 and 14.1.2.1.0 as documented at https://www.oracle.com/security-alerts/cpujul2026.html; Oracle publishes exact patch and bundle numbers per product within the CPU rather than a single tagged release, so consult that advisory for the precise patch identifier for your version (Patch available per vendor advisory). Because exploitation requires high privileges (PR:H), the most effective compensating controls until patching are to tightly restrict and audit accounts holding administrative or high privileges in OUD, rotate and closely monitor directory admin credentials, and enforce least privilege on ACIs so few identities can perform bulk create/delete/modify operations. Restrict network reachability of the LDAP/LDAPS listeners to trusted management hosts via firewall or network ACLs to shrink the attack surface - noting this can disrupt legitimate application binds if not scoped carefully - and enable detailed LDAP audit and change logging to detect anomalous mass modifications or repeated crash-inducing requests.