Oracle Unified Directory EUVD-2026-37294

Exploitation requires only network reachability to an Oracle Unified Directory 12.2.1.4.0 or 14.1.2.1.0 instance's LDAP or LDAPS listener (default ports 389/636 or 1389/1636) - no credentials, no user interaction, and no special server configuration are called out in Oracle's advisory, so default deployments of the affected versions are exploitable. The principal limiting factors are that OUD is typically deployed on internal identity-tier networks rather than internet-exposed, that only the two listed versions are confirmed affected (older 11g and unlisted patch levels are out of scope), and that organizations running mutual-TLS or IP-restricted LDAPS front-ends will force an attacker to first gain access to an authorized client network before reaching the vulnerable listener.

The CVSS vector AV:N/AC:L/PR:N/UI:N is the worst-case prerequisites profile - fully remote, low complexity, no privileges, no user interaction - making this trivially scriptable against any internet- or intranet-exposed OUD instance, which is why Oracle scored it 8.6 despite only partial confidentiality and availability impact (the high-integrity write is the dominant factor). However, real-world risk drivers are mixed: there is no CISA KEV listing, no public POC referenced, and no EPSS score supplied in the input, so exploitation appears not to be widespread today; Oracle CPU vulnerabilities are nonetheless routinely reverse-engineered from patch diffs within weeks, and OUD typically sits behind perimeter controls rather than on the open internet, which moderates but does not eliminate exposure. Because LDAP directories are a high-value pivot point for identity compromise across an entire Oracle estate, the integrity impact (unauthorized creation/deletion/modification of directory entries) should be treated as a priority despite the absence of in-the-wild signals; treat as high-priority for any environment where OUD fronts authentication or authorization for other applications.

An attacker with network reachability to the OUD LDAP listener - for example a foothold on a workstation VLAN that can route to the directory tier - sends a crafted LDAP request that bypasses authentication or authorization, then issues add/modify/delete operations to inject a privileged account or alter group memberships consumed by downstream Oracle Access Manager. The attacker subsequently authenticates to a federated Fusion Middleware application using the implanted credentials, pivoting from directory compromise to full application-level access. No public exploit identified at time of analysis, but the AV:N/AC:L/PR:N/UI:N profile means a working exploit would be straightforward to script once details are reverse-engineered from the CPU bundle patch.