Oracle Unified Directory CVE-2026-60849

Exploitation requires: (1) network-level access to the Oracle Unified Directory LDAP service on port 389 or 636; (2) a valid low-privileged LDAP account - unauthenticated attackers cannot exploit this vulnerability, as the CVSS vector explicitly requires PR:L; and (3) high attack complexity (AC:H), meaning the attacker must satisfy undisclosed specific preconditions prior to or during the attack, which Oracle has not detailed publicly but may involve particular LDAP operation sequences, timing conditions, or configuration states. Exploitation is limited to Oracle Unified Directory versions 12.2.1.4.0 and 14.1.2.1.0 specifically - other versions are not confirmed affected. The AC:H requirement substantially reduces feasibility for automated or mass-exploitation scenarios. Scope change to dependent Oracle Fusion Middleware products occurs only in environments where OUD is actively integrated as an identity provider for those systems.

The CVSS 3.1 score of 8.5 (High) reflects genuine severity: network delivery, no user interaction, full C/I/A impact, and scope change. The primary risk moderator is AC:H, which indicates specific preconditions must be met - this substantially reduces opportunistic and automated exploitation feasibility compared to AC:L vulnerabilities. No EPSS probability score was provided, and the vulnerability is absent from the CISA KEV catalog, meaning active exploitation is neither confirmed nor refuted by available intelligence. The 'Information Disclosure' tag in the source data appears to significantly understate the actual impact, which Oracle's own CVSS assessment places at full takeover territory (C:H/I:H/A:H); defenders should not be misled by the tag. The scope change (S:C) is the most consequential risk amplifier in environments where OUD serves as the authentication backbone for Oracle E-Business Suite, Oracle Identity Governance, or other Fusion Middleware products - directory compromise cascades directly into those systems. Despite AC:H tempering raw CVSS score, the attack chain requires only a low-privileged LDAP account and network access, making this a genuine priority for Oracle Fusion Middleware operators rather than a high-CVSS-but-low-real-risk finding.

An attacker holding a low-privileged LDAP account - such as a standard directory bind account or a compromised service credential - sends a specially crafted LDAP request sequence to an internet- or intranet-accessible OUD instance on port 389 or 636, satisfying the specific preconditions implied by AC:H. Upon triggering the OUD Core flaw, the attacker achieves full takeover of the directory service and, via the confirmed scope change, can manipulate authentication and authorization data affecting all Oracle Fusion Middleware components that delegate identity decisions to OUD. No public exploit code has been identified at time of analysis.