Oracle Unified Directory EUVD-2026-37292

The attacker needs network reachability to the OUD Core LDAP service (typically TCP/389 or TCP/636) on an instance running supported version 12.2.1.4.0 or 14.1.2.1.0; no credentials, no user interaction, and no special configuration toggle are stated by Oracle as preconditions, matching the AV:N/AC:L/PR:N/UI:N vector. The principal limiting factor is therefore network exposure of the LDAP listener: deployments where OUD is reachable only from a hardened management VLAN or a fixed set of application servers materially reduce the attack surface, while internet-exposed or flat-network OUD instances are exploitable against default configurations. Version is also limiting - only the two listed Fusion Middleware branches are confirmed affected in the source data.

All available signals point to a high-priority issue: the CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N is fully unauthenticated and network-reachable, scope unchanged but with C:H/I:H/A:H amounting to a 9.8 critical score, and Oracle itself characterizes successful attacks as 'takeover' of the product. There is no EPSS score, no KEV listing, and no public POC in the provided intelligence, so the issue is currently best described as no public exploit identified at time of analysis rather than actively exploited. The asymmetry is notable - Oracle Critical Patch Updates routinely become exploitation targets within weeks of disclosure, especially for unauthenticated network-vector flaws in identity infrastructure, so absence of KEV/POC today should not be read as low real-world risk. No CWE was published in the input, which limits root-cause analysis; the description's 'easily exploitable' phrasing is Oracle's, not an independent assessment, and should be corroborated against the CPU bulletin once detailed write-ups appear.

An attacker on a network segment that can reach the OUD LDAP port sends a crafted LDAP request to the OUD Core listener and, without authenticating, triggers the flaw to take control of the directory service. From that position the attacker reads or modifies user, group, and credential data, then pivots by issuing forged authentication responses or planting attacker-controlled accounts that any application relying on OUD will trust. No public exploit identified at time of analysis, but the low-complexity unauthenticated vector makes development of one straightforward once technical details emerge.