Oracle Unified Directory CVE-2026-60895

The attacker must possess a low-privileged authenticated account within Oracle Unified Directory with the ability to initiate LDAP connections to the server (port 389 or 636). Network access to the OUD LDAP listener is required. High attack complexity (AC:H) implies that additional conditions beyond mere network connectivity and credentials must be met - likely a specific LDAP operation sequence, timing dependency, or particular server configuration state - though Oracle has not publicly disclosed the precise triggering condition. Exploitation is limited to Oracle Unified Directory versions 12.2.1.4.0 and 14.1.2.1.0 specifically; no availability impact results from the attack. No user interaction on the server side is required once the attacker's LDAP session is established.

The CVSS 3.1 base score of 6.8 (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N) reflects a network-reachable flaw that nonetheless requires high attack complexity - meaning exploitation is not straightforward and likely depends on specific conditions such as race conditions, particular LDAP operation sequences, or precise server state. PR:L confirms the attacker must hold at least a low-privileged directory account, raising the barrier versus unauthenticated attacks. The C:H/I:H impact pair is severe, as OUD commonly stores credentials, group memberships, and identity attributes used across downstream Oracle and third-party systems; a compromise could propagate to those consumers. No EPSS score was provided, and the vulnerability is not listed in the CISA KEV catalog, indicating no confirmed active exploitation. Overall, real-world risk is moderate-to-elevated for Oracle-centric enterprises with externally or semi-externally exposed LDAP endpoints, but the AC:H metric meaningfully reduces the likelihood of opportunistic automated exploitation.

An attacker with a valid low-privileged LDAP account - for example, a service account or a recently onboarded employee - connects to the OUD LDAP listener and sends a specially crafted sequence of LDAP operations designed to bypass authorization enforcement in OUD Core. Upon successful exploitation, the attacker gains the ability to read the full directory tree (exposing password hashes, group memberships, and identity attributes) and to create, modify, or delete critical directory entries, potentially enabling privilege escalation across downstream Oracle systems that trust OUD as their identity provider. No public proof-of-concept code has been identified, and the high attack complexity suggests this scenario requires non-trivial knowledge of the LDAP request structure or server internals.