What is the CVSS score of EUVD-2026-46774?

EUVD-2026-46774 has a CVSS 3.1 base score of 10.0 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Oracle Unified Directory are affected by EUVD-2026-46774?

A critical vulnerability in Oracle Unified Directory (OUD) versions 12.2.1.4.0 and 14.1.2.1.0 enables remote attackers to achieve complete system compromise, directly threatening identity and access…

How to fix or mitigate EUVD-2026-46774?

Within 24 hours: Identify and document all systems running OUD 12.2.1.4.0 or 14.1.2.1.0, and immediately implement firewall rules restricting LDAP (ports 389/636) access to authorized networks only. Within 7 days: Complete network segmentation to isolate OUD instances, deploy network-based monitoring for suspicious LDAP traffic patterns, and prepare a contingency plan for OUD service disruption if emergency isolation becomes necessary. Within 30 days: Establish priority with Oracle for patch availability and deployment roadmap, evaluate alternative identity directory solutions, and conduct a security assessment of systems that may have been accessed through OUD.

Oracle Unified Directory EUVD-2026-46774

| CVE-2026-60360 CRITICAL

Missing Authentication for Critical Function (CWE-306)

2026-07-21 secalert_us@oracle.com

GHSA-6v5m-8qfv-2x66

Authentication Bypass Oracle Unified Directory

10.0

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

10.0 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

10.0 CRITICAL

Pre-auth network LDAP attack with low complexity and full directory takeover justifies PR:N/AC:L/AV:N; scope change (S:C) reflects impact on identity-dependent products, with full C/I/A loss.

3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 02:50 vuln.today

CVE Published

Jul 21, 2026 - 22:17 nvd

CRITICAL 10.0

DescriptionCVE.org

Vulnerability in the Oracle Unified Directory product of Oracle Fusion Middleware (component: OUD Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via LDAP to compromise Oracle Unified Directory. While the vulnerability is in Oracle Unified Directory, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Unified Directory. CVSS 3.1 Base Score 10.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H).

AnalysisAI

Complete takeover of Oracle Unified Directory (OUD) is possible when an unauthenticated remote attacker sends crafted traffic to the LDAP service in supported versions 12.2.1.4.0 and 14.1.2.1.0 of this Oracle Fusion Middleware component. The maximum CVSS 3.1 base score of 10.0 reflects full confidentiality, integrity, and availability loss plus a scope change that can significantly impact adjacent products. No public exploit identified at time of analysis, and the CVE is not listed in CISA KEV.

Technical ContextAI

Oracle Unified Directory is Oracle's all-in-one LDAP directory service (storage, proxy, synchronization, and virtualization) built on the Oracle Berkeley DB Java Edition backend and shipped as part of Oracle Fusion Middleware. The vulnerable element is 'OUD Core', reached over the LDAP protocol (typically TCP 389/636/1389). The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) indicates a network-reachable, low-complexity, pre-authentication flaw whose scope change (S:C) means a compromise of the directory can cross a trust/security boundary into other products that rely on OUD for identity. Oracle assigned no CWE (CWE: N/A) and, per its standard CPU disclosure practice, does not publish root-cause technical detail; the class of defect (e.g., LDAP request parsing/authentication bypass) cannot be confirmed from the available data.

RemediationAI

Apply the fixes delivered in the Oracle Critical Patch Update of July 2026 (Patch available per vendor advisory) documented at https://www.oracle.com/security-alerts/cpujul2026.html; the input does not name an exact patched build number, so identify the specific OUD 12.2.1.4.0 and 14.1.2.1.0 bundle patch for your platform directly from that CPU page and its patch matrix. Because this is pre-authentication over LDAP with a scope change, prioritize patching internet- or partner-facing OUD instances first. Until patched, restrict network reachability of the LDAP/LDAPS listeners (typically TCP 389/636/1389/1636) to only trusted application hosts via firewall or network ACLs, and place OUD behind a segmented management network - noting the trade-off that overly tight ACLs can break legitimate directory-dependent applications and synchronization, so validate the allow-list against your identity-consuming services before enforcing.