Oracle Unified Directory CVE-2026-60969

Exploitation requires: (1) a valid low-privileged LDAP credential for the target OUD instance, confirmed by the CVSS PR:L metric - unauthenticated external attackers cannot exploit this directly without first obtaining an account through other means; (2) network access to the OUD LDAP service endpoint (AV:N), typically TCP port 389 or 636, which may be exposed internally or, in misconfigured deployments, externally; (3) one of the two confirmed vulnerable versions: 12.2.1.4.0 or 14.1.2.1.0. Attack complexity is low (AC:L), indicating the bypass is reliable and does not require race conditions or environmental prerequisites beyond the above. No user interaction is required (UI:N). Scope change impact on additional Fusion Middleware products is conditional on whether those products are integrated with and actively consume identity data from the affected OUD instance - isolated OUD deployments are not subject to scope escalation.

The CVSS 3.1 score of 7.7 (High) accurately reflects meaningful real-world risk: the attack vector is network-based LDAP (AV:N), complexity is low (AC:L), no user interaction is required (UI:N), and the scope change (S:C) amplifies organizational impact in integrated Oracle environments. The PR:L requirement is the primary limiting factor - exploitation demands at least a low-privileged LDAP credential, which raises the bar above pure unauthenticated exposure. However, the 'Authentication Bypass' tag suggests that once a minimal credential is obtained, the attacker's effective access significantly exceeds their authorization level. No EPSS score was provided in the available intelligence, and this CVE is not listed in CISA KEV, indicating no confirmed widespread active exploitation at time of analysis. The absence of a public exploit code further tempers immediate urgency. Risk priority is HIGH for organizations running Oracle Fusion Middleware with OUD as an identity backbone (where scope change can propagate laterally), and MEDIUM for standalone OUD deployments with limited integration.

An attacker possessing a low-privileged LDAP service account - obtained through credential stuffing, phishing, or internal access - connects to the OUD LDAP endpoint over the network and sends crafted LDAP queries that trigger the authorization bypass in OUD Core. The attacker retrieves restricted directory attributes, including sensitive identity data, credentials, or group memberships belonging to privileged accounts, and may then leverage this data to pivot into integrated Oracle Fusion Middleware components such as Oracle Access Manager that trust OUD as an authoritative identity source. No public exploit code has been identified at time of analysis.