Oracle Unified Directory CVE-2026-60520

Exploitation requires network access to an Oracle Unified Directory LDAP/LDAPS listener and a valid low-privilege authenticated LDAP session (CVSS PR:L) - it is NOT anonymous/pre-auth despite the 'Authentication Bypass' tag, which appears to describe intra-directory access-control bypass rather than unauthenticated entry. No user interaction is needed (UI:N) and attack complexity is low (AC:L), and Oracle labels it 'easily exploitable'. Affected deployments are limited to OUD Core in Fusion Middleware versions 12.2.1.4.0 and 14.1.2.1.0; the primary limiting factors are the need for at least a low-privilege bind credential and network reachability of the LDAP service, so directories with tightly restricted listener exposure and no untrusted low-privilege accounts face materially lower risk.

The signals are moderately concerning but not emergency-tier. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N, base 8.1) indicates a network-reachable, low-complexity attack needing only low privileges and no user interaction, which Oracle reinforces by calling it 'easily exploitable' - a meaningful escalation risk for any exposed OUD instance. Countering that, there is no EPSS score provided, the CWE is unassigned, the flaw is NOT in CISA KEV, and no POC or active-exploitation evidence exists, so this is currently a high-CVSS issue without demonstrated real-world exploitation. Note a mild tension worth verifying with the vendor: the 'Authentication Bypass' tag implies pre-auth impact, yet the CVSS vector requires PR:L (a valid low-privilege account), so the realistic prerequisite is an authenticated-but-unprivileged foothold rather than fully anonymous access.

An attacker who has obtained or been issued a low-privilege OUD account (for example a limited application service bind or a compromised standard user) connects to the directory's LDAP port over the network and issues crafted LDAP operations that bypass intended access scoping. Without any user interaction, they read and alter directory entries far beyond their authorization - extracting credentials/attributes and tampering with entitlement data across the whole directory. No public POC is identified at time of analysis, but Oracle characterizes the attack as easily exploitable given low complexity.