Oracle Unified Directory CVE-2026-60519

Exploitation requires the attacker to already hold a high-privileged directory identity (CVSS PR:H) and to have network reachability to the Oracle Unified Directory LDAP service; no end-user interaction is needed (UI:N) and attack complexity is low (AC:L). This is NOT an unauthenticated remote flaw - the PR:H metric confirms authentication at a privileged level is a hard prerequisite, which limits realistic exploitation to malicious insiders, compromised admin/service accounts, or attackers who have already escalated privileges. It affects only supported versions 12.2.1.4.0 and 14.1.2.1.0; the specific LDAP operation or feature abused is not detailed by Oracle (no CWE assigned).

The signals are moderate and mostly consistent. The CVSS 3.1 base score is 7.2 (High) driven by full C/I/A impact and low attack complexity, but the PR:H requirement is the dominant limiting factor - an attacker must already hold high directory privileges, which substantially narrows the realistic threat to insiders, compromised admin credentials, or chained privilege escalation. No EPSS score, SSVC decision, POC, or KEV entry was provided in the input, so exploitation probability cannot be quantified from data and there is no evidence of active exploitation. Oracle's own 'easily exploitable' language refers to attack complexity once privileges are held (AC:L), not to ease of gaining those privileges - these should not be conflated. Net assessment: a genuine High-severity issue worth patching in the next Oracle CPU cycle, but not an emergency drop-everything item absent evidence of exploitation, given the high privilege prerequisite.

An attacker who has obtained a high-privilege OUD account - for example a leaked directory administrator credential or a compromised service account with elevated LDAP rights - connects to the directory over the network via LDAP and issues crafted privileged operations that lead to full takeover of the Oracle Unified Directory instance. No public proof-of-concept is identified at time of analysis, and low attack complexity means that once the privileged access exists, exploitation is straightforward.