What is the CVSS score of CVE-2026-60520?

CVE-2026-60520 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.4%.

Which versions of Oracle Unified Directory are affected by CVE-2026-60520?

Oracle Unified Directory (OUD) versions 12.2.1.4.0 and 14.1.2.1.0 contain a critical authentication-bypass vulnerability that allows attackers with network access to compromise user identity and…

How to fix or mitigate CVE-2026-60520?

Within 24 hours, inventory all Oracle Unified Directory 12.2.1.4.0 and 14.1.2.1.0 deployments and assess network exposure, particularly any LDAP endpoints accessible from untrusted networks. Within 7 days, implement firewall rules restricting LDAP access (ports 389 and 636) to authorized clients only, enable comprehensive logging and alerting on LDAP directory modifications and suspicious queries, and perform baseline audits of critical directory data for integrity. Within 30 days, contact Oracle support for guidance on available mitigations or upgrade timelines to patched versions, evaluate migration of OUD instances to newer releases when patches become available, and conduct forensic review of LDAP access logs for evidence of unauthorized data access or modification.

Oracle Unified Directory CVE-2026-60520

EUVD-2026-46882 HIGH

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-g5m9-h5x4-5px6

Authentication Bypass Oracle Unified Directory

8.1

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

vuln.today AI

8.1 HIGH

Network-reachable over LDAP with low complexity, but requires an authenticated low-privilege bind (PR:L); high confidentiality/integrity data access, no availability impact, no scope change.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 09:12 vuln.today

CVE Published

Jul 21, 2026 - 22:17 nvd

HIGH 8.1

DescriptionCVE.org

Vulnerability in the Oracle Unified Directory product of Oracle Fusion Middleware (component: OUD Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows low privileged attacker with network access via LDAP to compromise Oracle Unified Directory. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Unified Directory accessible data as well as unauthorized access to critical data or complete access to all Oracle Unified Directory accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).

AnalysisAI

Data compromise in Oracle Unified Directory 12.2.1.4.0 and 14.1.2.1.0 (OUD Core component of Oracle Fusion Middleware) allows a low-privileged, network-adjacent attacker to read, create, delete, or modify all directory-accessible data over LDAP. Rated CVSS 3.1 8.1 with high confidentiality and integrity impact but no availability impact, the flaw is described by Oracle as 'easily exploitable' and is tagged as an authentication-bypass class issue. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Technical ContextAI

Oracle Unified Directory (OUD) is Oracle's enterprise LDAPv3 directory server used for identity storage, authentication, and directory-based access control within the Fusion Middleware stack. The vulnerability sits in the OUD Core component and is reachable through the LDAP protocol itself, meaning the directory service's own request-processing path is the attack surface. Oracle assigned no CWE, but the vendor tag 'Authentication Bypass' combined with a C:H/I:H/A:N impact profile suggests an access-control or privilege-scoping weakness that lets an already-authenticated low-privilege bind escalate its effective read/write reach across data it should not be able to touch, rather than a memory-safety or denial-of-service bug (availability is explicitly unaffected).

RemediationAI

Apply the fixes delivered in the Oracle Critical Patch Update of July 2026 (https://www.oracle.com/security-alerts/cpujul2026.html) - Patch available per vendor advisory; the input does not specify an exact fixed build number, so obtain the precise patch level for your 12.2.1.4.0 or 14.1.2.1.0 deployment directly from the Oracle CPU matrix and My Oracle Support. Because exploitation requires an authenticated low-privilege LDAP session, effective compensating controls until patching are to restrict network reachability of the LDAP/LDAPS listeners to trusted management and application subnets via firewall or network ACLs (trade-off: may break legitimate remote clients that must be explicitly allow-listed), tighten and audit existing low-privilege bind accounts and their ACIs to reduce the blast radius, and increase monitoring/logging of LDAP operations for anomalous read/modify activity across sensitive subtrees (trade-off: added log volume). Do not rely on these controls as a substitute for the CPU patch.