What is the CVSS score of EUVD-2026-46775?

EUVD-2026-46775 has a CVSS 3.1 base score of 9.9 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Oracle Unified Directory are affected by EUVD-2026-46775?

Oracle Unified Directory (OUD Core) versions 12.2.1.4.0 and 14.1.2.1.0 contain a critical privilege escalation vulnerability (CVSS 9.9) allowing low-privileged attackers to gain complete…

How to fix or mitigate EUVD-2026-46775?

Within 24 hours: audit systems running OUD Core 12.2.1.4.0 or 14.1.2.1.0, map network access to LDAP services, and document dependent systems. Within 7 days: implement network segmentation restricting LDAP access to authorized systems only, disable LDAP on non-production instances, and enable enhanced logging and monitoring for LDAP authentication attempts. Within 30 days: monitor Oracle's Critical Patch Update channel for a security release and develop an upgrade plan to remediated versions; until patched, maintain strict network controls and consider rate-limiting LDAP queries to hinder exploitation attempts.

Oracle Unified Directory EUVD-2026-46775

| CVE-2026-60361 CRITICAL

Missing Authentication for Critical Function (CWE-306)

2026-07-21 secalert_us@oracle.com

GHSA-j6c3-7cmf-gx27

Authentication Bypass Oracle Unified Directory

9.9

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

9.9 CRITICAL

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

9.9 CRITICAL

Network LDAP vector with low complexity and only a low-privilege credential (PR:L); full takeover gives C/I/A High and OUD's identity role justifies the scope change (S:C).

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 02:50 vuln.today

CVE Published

Jul 21, 2026 - 22:17 nvd

CRITICAL 9.9

DescriptionCVE.org

Vulnerability in the Oracle Unified Directory product of Oracle Fusion Middleware (component: OUD Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows low privileged attacker with network access via LDAP to compromise Oracle Unified Directory. While the vulnerability is in Oracle Unified Directory, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Unified Directory. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).

AnalysisAI

Privilege escalation to full takeover in Oracle Unified Directory (OUD Core) 12.2.1.4.0 and 14.1.2.1.0 lets a low-privileged attacker with LDAP network access completely compromise the directory service, with a scope change that can significantly impact other connected products. Oracle rates it CVSS 3.1 9.9 with full confidentiality, integrity, and availability loss. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and 'easily exploitable' characterization make this a high-priority patch from the July 2026 Oracle Critical Patch Update.

Technical ContextAI

Oracle Unified Directory is Oracle's LDAP-based directory server (an all-in-one directory, proxy, and synchronization gateway built on the OpenDS/OUD codebase) shipped as part of Oracle Fusion Middleware. The affected component, OUD Core, handles LDAP protocol operations and directory data. Oracle assigned no CWE, but the combination of a low-privileged LDAP vector, high impact across C/I/A, and a scope change points to an authorization or trust-boundary weakness in how OUD processes authenticated LDAP operations - allowing an actor who already holds a limited directory credential to escalate to full control of the directory and, through OUD's role as an identity/proxy tier, to affect downstream systems that rely on it for authentication.

RemediationAI

Apply the fixes in the Oracle Critical Patch Update of July 2026 (https://www.oracle.com/security-alerts/cpujul2026.html) - this is the vendor-released remediation channel for both affected releases (12.2.1.4.0 and 14.1.2.1.0); an exact patched build number was not provided in the input, so consult the CPU matrix for the specific patch ID for your version. Until the CPU can be applied, reduce exposure by restricting network reachability of the LDAP/LDAPS listener to trusted management networks and application tiers only (side effect: any client that connects directly must be re-homed or allowlisted), tightening and auditing low-privileged directory accounts and their ACIs since the attacker needs only limited credentials (side effect: over-restriction can break dependent app bind accounts), and increasing monitoring of LDAP operations for anomalous privileged changes. Because of the scope change, also review and constrain what downstream products trust OUD-issued identities so a directory compromise does not automatically cascade.