What is the CVSS score of EUVD-2026-37292?

EUVD-2026-37292 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Oracle Unified Directory are affected by EUVD-2026-37292?

Oracle Unified Directory (OUD versions 12.2.1.4.0 and 14.1.2.1.0) contains a critical unauthenticated remote vulnerability (CVSS 9.8) requiring only network access to the LDAP service, enabling an…

How to fix or mitigate EUVD-2026-37292?

WITHIN 24 HOURS: Inventory all OUD deployments running 12.2.1.4.0 or 14.1.2.1.0; immediately restrict LDAP/LDAPS network access (ports 389/636) to authorized internal systems only via firewall rules; review LDAP audit logs for unauthorized access or modifications. WITHIN 7 DAYS: Implement network segmentation isolating OUD from untrusted networks; enable comprehensive audit logging for all directory operations; rotate all directory administrator credentials; engage Oracle support for interim hardening guidance. WITHIN 30 DAYS: Apply Oracle vendor patch immediately upon release (monitor Critical Patch Updates); conduct full directory integrity audit; validate all credentials and permissions modified during exposure window.

Oracle Unified Directory EUVD-2026-37292

| CVE-2026-46773 CRITICAL

Improper Access Control (CWE-284)

2026-06-16 oracle

Authentication Bypass Oracle Oracle Unified Directory Oracle Corporation

9.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

LDAP service is network-reachable (AV:N), Oracle calls it easily exploitable with no auth or interaction (AC:L/PR:N/UI:N), and 'takeover' implies full C:H/I:H/A:H with no scope change.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 16, 2026 - 23:11 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle Unified Directory product of Oracle Fusion Middleware (component: OUD Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via LDAP to compromise Oracle Unified Directory. Successful attacks of this vulnerability can result in takeover of Oracle Unified Directory. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Unauthenticated LDAP-based takeover of Oracle Unified Directory affects supported versions 12.2.1.4.0 and 14.1.2.1.0 within Oracle Fusion Middleware, allowing a remote attacker with network reachability to the LDAP service to fully compromise the directory server. The flaw carries a CVSS 3.1 base score of 9.8 with high confidentiality, integrity, and availability impact, and no public exploit identified at time of analysis. Because directory services underpin enterprise identity, successful exploitation cascades into authentication and authorization decisions for every downstream application that relies on OUD.

Technical ContextAI

Oracle Unified Directory (OUD) is Oracle's all-in-one LDAPv3-compliant directory service shipped as part of Fusion Middleware, providing storage, proxy, and synchronization for identity data. The vulnerable component is identified as 'OUD Core', the engine that parses and processes LDAP protocol operations such as BIND, SEARCH, MODIFY, and extended requests, which is exposed by default on TCP/389 (LDAP) and/or TCP/636 (LDAPS). No CWE was assigned by Oracle in the input data, but the combination of network LDAP vector, low attack complexity, no privileges, and full CIA impact is consistent with a memory-corruption or authentication/protocol-handling defect in the LDAP request parser of OUD Core. The CPE 'cpe:2.3:a:oracle_corporation:oracle_unified_directory' confirms the scope is the OUD application itself, not the underlying WebLogic or JDK stack.

RemediationAI

Apply the patches delivered in the Oracle Critical Patch Update of June 2026 as documented at https://www.oracle.com/security-alerts/cspujun2026.html for the affected branches 12.2.1.4.0 and 14.1.2.1.0; treat patch status as 'Patch available per vendor advisory' since the input does not list a specific fixed sub-version. If immediate patching is not feasible, restrict network reachability of the LDAP (389) and LDAPS (636) listeners to a tightly scoped allow-list of application servers and identity consumers via firewall or network policy, which contains exposure but will break any service that legitimately reached OUD from outside that list. Avoid exposing OUD to the internet under any circumstance, increase logging on LDAP BIND and extended operations to detect anomalous client patterns, and front OUD with a hardened reverse proxy only if it can terminate and re-emit LDAP cleanly - generic L4 load balancers will not mitigate a protocol-level flaw.