Oracle Unified Directory EUVD-2026-46833

The exploit requires only network reachability to the Oracle Unified Directory LDAP service (default TCP 389/636) on affected versions 12.2.1.4.0 or 14.1.2.1.0; per the CVSS vector AV:N/AC:L/PR:N/UI:N there is no authentication, no user interaction, and no special configuration required beyond a running, reachable OUD LDAP listener. The primary limiting factor is network exposure: if the LDAP port is segmented to trusted internal clients only, remote untrusted exploitation is prevented, so realistic risk depends chiefly on whether the listener is reachable from attacker-controlled networks rather than on any product feature toggle.

The CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H describes a network-reachable, low-complexity, unauthenticated attack requiring no user interaction, with impact limited to availability (A:H) - a clean, single-signal DoS with no data exposure. The 7.5 base score is driven entirely by that availability loss; because there is no confidentiality or integrity impact, this is a service-continuity risk rather than a compromise risk. No EPSS score, POC, or KEV entry was provided, so exploitation probability cannot be quantified from the input and no active exploitation is confirmed. The practical priority hinges on exposure: an OUD instance whose LDAP port is reachable from untrusted networks is at meaningful risk of trivial takedown, whereas an internal-only directory behind network controls is lower urgency. No conflicting signals were observed between the description (LDAP, unauthenticated) and the CVSS vector (AV:N/PR:N).

An attacker who can reach the OUD LDAP listener sends a crafted or abusive LDAP operation that drives OUD Core into a hang or repeatable crash, taking the directory offline. Because authentication is not required and complexity is low, the attacker can script the request and re-send it to keep the service down, disrupting every application that depends on OUD for authentication. No public proof-of-concept was identified at time of analysis.