Oracle Unified Directory EUVD-2026-46773

Exploitation requires network reachability to the HTTP interface of an affected Oracle Unified Directory instance (versions 12.2.1.4.0 or 14.1.2.1.0, OUD Core); per the CVSS vector (AV:N/AC:L/PR:N/UI:N) no authentication, no user interaction, and no elevated privileges are needed against a reachable instance - Oracle explicitly calls it 'easily exploitable' by an unauthenticated attacker. The primary limiting factors are exposure and version: an OUD instance whose HTTP listener is confined to an isolated management segment, fronted by an authenticating proxy, or already patched via the July 2026 CPU is not exploitable. Impact is bounded to confidentiality (C:H, I:N, A:N), so a successful attack yields data disclosure - including access to additional products via the scope change - but not data modification or denial of service.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N, base 8.6) describes an easy, network-reachable, unauthenticated read-only compromise with cross-product scope impact - a genuinely high-priority profile for any internet- or intranet-exposed OUD instance, since directories often hold credentials and account data that enable follow-on attacks. However, the risk signals are incomplete: no EPSS score, no SSVC decision, and no CWE were provided, so exploitation probability cannot be quantified from the input. It is not in CISA KEV and no POC is referenced, so there is no evidence of active or public exploitation despite the high CVSS. The 'authentication bypass' tag reinforces that the primary risk is unauthorized data disclosure rather than code execution or service disruption (I:N/A:N). Net: treat as high priority for exposed identity infrastructure based on ease and impact, but note the absence of exploitation telemetry (EPSS/KEV/POC) means urgency rests on the severity of the asset, not on confirmed in-the-wild activity.

A remote attacker with no credentials sends crafted HTTP requests to an exposed Oracle Unified Directory instance and bypasses authentication to read protected directory entries such as user records, group memberships, and potentially credential material. Because of the scope change, the attacker leverages this disclosed identity data to pivot into other applications that trust the directory. No public exploit code is currently identified, so this scenario is inferred from the CVSS vector and vendor description rather than from a demonstrated POC.