What is the CVSS score of CVE-2026-60519?

CVE-2026-60519 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Oracle Unified Directory are affected by CVE-2026-60519?

Oracle Unified Directory in Fusion Middleware versions 12.2.1.4.0 and 14.1.2.1.0 is vulnerable to complete compromise by high-privileged network users, potentially disrupting authentication…

How to fix or mitigate CVE-2026-60519?

Within 24 hours, identify all instances of Oracle Fusion Middleware versions 12.2.1.4.0 and 14.1.2.1.0 and document dependencies on OUD for authentication. Within 7 days, implement network segmentation to restrict LDAP access to authorized systems only, audit and minimize high-privilege directory service accounts, enable enhanced logging on LDAP connections, and implement firewall rules to control network access. Within 30 days, develop an upgrade plan for patched Fusion Middleware versions when available, conduct a security audit of directory service access controls, and implement additional protective controls such as LDAP authorization hardening and enhanced monitoring for suspicious activity.

Oracle Unified Directory CVE-2026-60519

EUVD-2026-46881 HIGH

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-p85c-8j48-8cxj

Authentication Bypass Oracle Unified Directory

7.2

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

7.2 HIGH

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.2 HIGH

Reachable over the network via LDAP (AV:N/AC:L) but requires an existing high-privilege directory identity (PR:H), with full takeover yielding C:H/I:H/A:H and no scope change.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 04:22 vuln.today

CVE Published

Jul 21, 2026 - 22:17 nvd

HIGH 7.2

DescriptionCVE.org

Vulnerability in the Oracle Unified Directory product of Oracle Fusion Middleware (component: OUD Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows high privileged attacker with network access via LDAP to compromise Oracle Unified Directory. Successful attacks of this vulnerability can result in takeover of Oracle Unified Directory. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Takeover of Oracle Unified Directory is possible in Oracle Fusion Middleware versions 12.2.1.4.0 and 14.1.2.1.0 (OUD Core component), where a high-privileged attacker with network access via LDAP can fully compromise the directory service. Oracle rates this CVSS 7.2 with high confidentiality, integrity, and availability impact, and describes it as 'easily exploitable' once the required privileges are held. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, so risk is gated primarily by the authentication requirement.

Technical ContextAI

Oracle Unified Directory (OUD) is Oracle's enterprise LDAPv3 directory server and directory proxy, part of the Oracle Fusion Middleware stack and commonly used as an identity store backing applications such as Oracle Access Manager, Oracle Identity Governance, and E-Business Suite. The affected 'OUD Core' component is the server engine that processes LDAP operations (binds, searches, modifications) over the network. No CWE was assigned by NVD/Oracle, so the precise root cause class is not disclosed; the CVSS vector (AV:N, LDAP protocol, PR:H) indicates the flaw is reachable over the network but is only triggerable by an already-authenticated, high-privilege LDAP identity, consistent with a privileged-operation weakness in core LDAP request handling rather than an unauthenticated protocol bug.

RemediationAI

Apply the fixes delivered in the Oracle Critical Patch Update of July 2026 (https://www.oracle.com/security-alerts/cpujul2026.html) for the affected Oracle Unified Directory 12.2.1.4.0 and 14.1.2.1.0 releases; treat 'Patch available per vendor advisory' as the status, since the CPU bundles the fix rather than publishing a standalone tagged version and no exact patched build number is given in the input. Because exploitation requires a high-privileged LDAP identity, the key compensating controls until patching are to tightly restrict and audit accounts holding administrative or high-privilege directory roles, rotate and vault privileged bind credentials, and enforce network segmentation so the LDAP/LDAPS ports (typically 389/636 or configured admin ports) are reachable only from trusted management hosts - accepting that overly aggressive network restriction can break legitimate identity-consuming applications and should be validated against your integration topology. Enable and monitor OUD access/audit logs for anomalous privileged operations as a detection layer.