Oracle Unified Directory CVE-2026-60841

Exploitation requires a low-privileged account capable of authenticating to Oracle Unified Directory over LDAP (PR:L) - any valid LDAP bind account, including application service accounts or standard user accounts, satisfies this requirement. The AC:H rating confirms that exploitation is not straightforward and likely demands specific directory state, a precise sequence of LDAP operations, or timing-dependent conditions; Oracle has not publicly disclosed the exact complexity requirement, so this cannot be further characterized from available data. Affected deployments are limited to Oracle Unified Directory versions 12.2.1.4.0 and 14.1.2.1.0 - other versions are not confirmed vulnerable. The attack vector is network-based (AV:N), so OUD instances firewalled to prevent LDAP access from untrusted or low-privileged account holders are not at risk from this specific path. No user interaction is required once access conditions are satisfied (UI:N). The scope change means exploitation impact is not bounded by the OUD process itself.

The CVSS 3.1 score of 8.5 reflects a serious but non-trivial attack: AV:N confirms network reachability via LDAP, but AC:H indicates the attacker must overcome significant complexity - likely requiring specific directory state, precise sequencing of LDAP operations, or timing constraints whose exact nature Oracle has not disclosed. PR:L adds a meaningful authentication barrier, requiring the attacker to possess a valid low-privileged LDAP account. Despite these constraints, the S:C/C:H/I:H/A:H impact cluster makes successful exploitation catastrophic: a compromised LDAP directory serving as an identity backbone can de-facto compromise every downstream system trusting it for authentication. No EPSS score was provided in the source data, preventing probabilistic exploitation likelihood assessment. Without KEV confirmation or POC availability, this should be treated as a high-priority scheduled patching target rather than an emergency break-glass response, particularly for OUD instances not exposed to low-privileged untrusted accounts. The EUVD 'Information Disclosure' tag conflicts with the full takeover CVSS impact - defenders should rely on the CVSS vector, not the tag, when assessing impact scope.

An attacker holding a low-privileged LDAP service account - such as an application bind account, a shared service credential, or a compromised internal user account - connects to an OUD instance over the network and sends a crafted sequence of LDAP operations designed to meet the high-complexity exploitation prerequisite. Upon satisfying those conditions, the attacker achieves full control of the OUD Core, gaining the ability to read all directory entries, modify user credentials, disable accounts, or deny directory service to dependent systems. From this position, they can pivot into any Oracle Fusion Middleware component that trusts OUD for authentication, effectively inheriting the directory's privileged position across the Oracle environment.