Unified Directory
Monthly
Oracle Unified Directory (OUD) versions 12.2.1.4.0 and 14.1.2.1.0 expose a network-accessible LDAP authorization bypass that enables a low-privileged authenticated attacker to gain unauthorized access to critical or complete directory data. Intelligence sources tag this as an authentication bypass in the OUD Core component, with confirmed scope change impact on additional Oracle Fusion Middleware products consuming OUD identity data. No active exploitation confirmed at time of analysis and no public exploit code has been identified; however, the low attack complexity and network accessibility make this a credible priority for Oracle Fusion Middleware environments.
Unauthenticated remote disclosure of all Oracle Unified Directory data is possible via the LDAP protocol in versions 12.2.1.4.0 and 14.1.2.1.0 of Oracle Unified Directory (Oracle Fusion Middleware). The 'Authentication Bypass' tag and a CVSS vector of AV:N/AC:L/PR:N/UI:N confirm that a network-accessible attacker with no credentials can exploit the OUD Core component to read critical or complete directory data. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and zero-privilege requirement make this a straightforward target for opportunistic scanning.
Unauthenticated remote data exposure in Oracle Unified Directory allows attackers with network access via LDAP to read all directory-accessible data without credentials. Affected versions 12.2.1.4.0 and 14.1.2.1.0 of this Fusion Middleware identity store component are vulnerable to what Oracle and ENISA tag as an authentication bypass. With a CVSS 3.1 score of 7.5 and an AV:N/AC:L/PR:N/UI:N vector, exploitation is considered trivial for any attacker with network reach to the LDAP service port. No public exploit code or CISA KEV listing has been identified at time of analysis, but the unauthenticated attack surface makes this a high-priority patch target for organizations running OUD as a directory backend.
Unauthenticated confidentiality breach in Oracle Unified Directory (OUD Core) exposes all directory-accessible data via LDAP. Both supported releases - 12.2.1.4.0 and 14.1.2.1.0 - are affected, confirming this is not a legacy-only issue. The 'Authentication Bypass' tag combined with a PR:N/AV:N CVSS vector indicates attackers can read sensitive directory contents without credentials over the network; no public exploit or CISA KEV listing has been identified at time of analysis.
Full takeover of Oracle Unified Directory (OUD) 12.2.1.4.0 and 14.1.2.1.0 is achievable by a low-privileged attacker with LDAP network access exploiting a flaw in the OUD Core component. The CVSS scope-change indicator (S:C) confirms that successful exploitation extends beyond the directory service itself, potentially compromising dependent Oracle Fusion Middleware applications that rely on OUD for identity and authentication services. No public exploit code or CISA KEV listing has been identified at time of analysis, though Oracle has acknowledged and addressed the issue in its August 2026 Critical Security Update.
Full takeover of Oracle Unified Directory 12.2.1.4.0 and 14.1.2.1.0 is achievable by a low-privileged network attacker via LDAP, resulting in complete compromise of confidentiality, integrity, and availability of the directory service. The CVSS Scope:Changed indicator confirms that successful exploitation can cascade into additional Oracle Fusion Middleware components that depend on OUD for authentication or directory services, amplifying the blast radius beyond the directory itself. No public exploit code or CISA KEV listing has been identified at time of analysis, but the catastrophic impact profile and identity-backbone role of LDAP directories make this a high-priority patching target under Oracle's August 2026 Critical Patch Update.
Data compromise in Oracle Unified Directory 12.2.1.4.0 and 14.1.2.1.0 (OUD Core component of Oracle Fusion Middleware) allows a low-privileged, network-adjacent attacker to read, create, delete, or modify all directory-accessible data over LDAP. Rated CVSS 3.1 8.1 with high confidentiality and integrity impact but no availability impact, the flaw is described by Oracle as 'easily exploitable' and is tagged as an authentication-bypass class issue. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Takeover of Oracle Unified Directory is possible in Oracle Fusion Middleware versions 12.2.1.4.0 and 14.1.2.1.0 (OUD Core component), where a high-privileged attacker with network access via LDAP can fully compromise the directory service. Oracle rates this CVSS 7.2 with high confidentiality, integrity, and availability impact, and describes it as 'easily exploitable' once the required privileges are held. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, so risk is gated primarily by the authentication requirement.
Data tampering and denial-of-service in Oracle Unified Directory (OUD Core component) let a high-privileged, network-adjacent attacker abuse the LDAP interface to modify or destroy directory data and force a complete crash or hang of the service. Affected supported versions are 12.2.1.4.0 and 14.1.2.1.0, addressed in the Oracle July 2026 Critical Patch Update. The flaw carries a scope change, meaning a successful attack can significantly impact products beyond OUD itself. No public exploit has been identified at time of analysis.
Denial of service in Oracle Unified Directory (OUD Core) versions 12.2.1.4.0 and 14.1.2.1.0 lets an unauthenticated attacker with LDAP network access hang or repeatedly crash the directory server, producing a complete availability outage. Oracle rates it CVSS 3.1 7.5 with availability-only impact and describes it as easily exploitable. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; confidentiality and integrity are unaffected.
Full compromise of Oracle Unified Directory (OUD Core component of Oracle Fusion Middleware) is possible when a low-privileged attacker sends malicious traffic over LDAP to affected versions 12.2.1.4.0 and 14.1.2.1.0. Oracle rates this 8.8 (CVSS 3.1) and characterizes it as 'easily exploitable,' with successful attacks resulting in complete takeover of the directory server, breaching confidentiality, integrity, and availability. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and network-facing LDAP interface make it a high-priority patch item.
Full takeover of Oracle Unified Directory is possible in the OUD Core component of Oracle Fusion Middleware versions 12.2.1.4.0 and 14.1.2.1.0, where a low-privileged attacker with LDAP network access can compromise the directory service and, because of a scope change, significantly impact additional connected products. Oracle rates this CVSS 9.9 and lists it in the July 2026 Critical Patch Update; there is no public exploit identified at time of analysis and it is not on CISA KEV. The combination of low attack complexity, only low privileges required, and cross-product blast radius makes this one of the highest-severity fixes in the CPU.
Unauthorized data access in Oracle Unified Directory 12.2.1.4.0 and 14.1.2.1.0 (OUD Core component) lets a remote unauthenticated attacker abuse the LDAP interface to read critical directory data and make limited unauthorized modifications. Rated CVSS 8.2 and flagged by Oracle as easily exploitable, the flaw is tagged as an authentication bypass, meaning directory contents can be reached without valid credentials. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Scope-changing compromise of Oracle Unified Directory (OUD Core) 12.2.1.4.0 and 14.1.2.1.0 lets a remote, unauthenticated attacker abuse the LDAP interface to read and alter all directory-accessible data, tagged by Oracle as an authentication bypass. Because OUD brokers identity and access for downstream Fusion Middleware systems, successful attacks carry a CVSS 3.1 scope change (S:C) and can significantly impact other products beyond the directory itself. No public exploit identified at time of analysis; exploitation is rated high-complexity (AC:H), so this is a serious but non-trivial-to-weaponize flaw addressed in Oracle's July 2026 Critical Patch Update.
Elevation-of-scope compromise in Oracle Unified Directory (Fusion Middleware, OUD Core component) versions 12.2.1.4.0 and 14.1.2.1.0 lets an authenticated low-privileged attacker with LDAP network access read all OUD-accessible data and modify some of it, with a scope change that can significantly impact additional connected products. Oracle rates it CVSS 3.1 8.5, and the source intelligence tags it as an authentication-bypass-class issue. There is no public exploit identified at time of analysis and it is not in CISA KEV, but the low attack complexity and scope change make it a meaningful patch priority for Oracle-integrated identity infrastructure.
Remote denial-of-service in Oracle Unified Directory (OUD Core) 12.2.1.4.0 and 14.1.2.1.0 lets an unauthenticated network attacker send crafted LDAP traffic that hangs or repeatedly crashes the directory service, producing a complete availability outage. Addressed in the Oracle Critical Patch Update of July 2026, the flaw carries CVSS 7.5 (availability-only) with no impact to confidentiality or integrity. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, so exploitation is currently theoretical rather than observed.
Full compromise of Oracle Unified Directory is possible in the OUD Core component of Oracle Fusion Middleware versions 12.2.1.4.0 and 14.1.2.1.0, where a remote attacker interacting over LDAP can take over the directory service and impact other trusting systems due to a scope change. The flaw scores CVSS 9.0 but is rated high attack complexity (AC:H), meaning exploitation is difficult despite requiring no authentication. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Full compromise of Oracle Unified Directory (OUD Core) is possible when a low-privileged attacker with network access sends malicious traffic over LDAP, per the July 2026 Oracle Critical Patch Update. Affected supported releases are 12.2.1.4.0 and 14.1.2.1.0, and Oracle rates the flaw as easily exploitable with a CVSS 3.1 base score of 8.8, resulting in complete takeover of the directory service. No public exploit identified at time of analysis and the CVE is not on CISA KEV, but authenticated LDAP reachability makes it a strong patching priority for exposed directory servers.
Privilege escalation and data compromise in Oracle Unified Directory 14.1.2.1.0 (OUD Core) lets a low-privileged, authenticated attacker with LDAP network access read, create, modify or delete all OUD-accessible data and cause a partial denial of service. Oracle rates it CVSS 9.9 with a scope change, meaning exploitation can significantly impact additional products beyond the directory itself. No public exploit identified at time of analysis and it is not listed in CISA KEV, but the near-maximum score and low attack complexity make it a top patching priority.
Privilege-scoped data compromise in Oracle Unified Directory (OUD Core) 12.2.1.4.0 and 14.1.2.1.0 lets a low-privileged, authenticated attacker with LDAP network access read and modify all directory-accessible data, with a scope change that can significantly impact other integrated products. Rated CVSS 3.1 8.2 (C:H/I:H, no availability impact) and tagged as an authentication-bypass class issue, though the attack is rated hard to execute (AC:H). No public exploit identified at time of analysis and it is not on CISA KEV.
Privilege escalation and cross-product data compromise in Oracle Unified Directory 12.2.1.4.0 and 14.1.2.1.0 (OUD Core) lets a low-privileged network attacker abuse the LDAP interface to gain complete read access to all directory-accessible data and partial write access. Vendor-tagged as an authentication bypass with a scope change, meaning successful attacks can significantly impact other products that rely on this directory. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV, but the CVSS 3.1 base score of 8.5 with 'easily exploitable' vendor language marks it as a high-priority patch.
Takeover of Oracle Unified Directory is possible in the OUD Core component of Oracle Fusion Middleware versions 12.2.1.4.0 and 14.1.2.1.0, where a low-privileged attacker with network access over LDAP can fully compromise the directory service. Rated CVSS 3.1 8.8 with high confidentiality, integrity, and availability impact, Oracle describes the flaw as 'easily exploitable', meaning an authenticated LDAP user can escalate to full control of the directory. No public exploit has been identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and authenticated-user prerequisite make it a high priority for LDAP-exposed deployments.
Privilege-based takeover of Oracle Unified Directory (OUD Core) affects Fusion Middleware versions 12.2.1.4.0 and 14.1.2.1.0, where a high-privileged attacker with LDAP network access can fully compromise the directory service. Successful exploitation yields complete takeover with high confidentiality, integrity, and availability impact (CVSS 3.1 base 7.2). No public exploit identified at time of analysis; addressed in Oracle's July 2026 Critical Patch Update.
Complete takeover of Oracle Unified Directory (OUD Core) is possible when a remote, unauthenticated attacker exploits a flaw reachable over the LDAP protocol in Oracle Fusion Middleware versions 12.2.1.4.0 and 14.1.2.1.0, per Oracle's July 2026 Critical Patch Update. Oracle rates the attack complexity as high, and a successful attack yields full confidentiality, integrity, and availability compromise (CVSS 8.1). There is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV, so exploitation would currently be theoretical or targeted rather than commodity.
Complete takeover of Oracle Unified Directory (OUD Core) is achievable by an unauthenticated, network-based attacker communicating over LDAP against supported versions 12.2.1.4.0 and 14.1.2.1.0. Rated CVSS 3.1 9.8 with full confidentiality, integrity, and availability impact and marked 'easily exploitable' by Oracle, the flaw yields product compromise without credentials or user interaction. No public exploit identified at time of analysis and the issue is not currently listed in CISA KEV, but the trivial exploitation profile makes it a top patching priority.
Privilege escalation to full takeover in Oracle Unified Directory (OUD Core) 12.2.1.4.0 and 14.1.2.1.0 lets a low-privileged attacker with LDAP network access completely compromise the directory service, with a scope change that can significantly impact other connected products. Oracle rates it CVSS 3.1 9.9 with full confidentiality, integrity, and availability loss. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and 'easily exploitable' characterization make this a high-priority patch from the July 2026 Oracle Critical Patch Update.
Complete takeover of Oracle Unified Directory (OUD) is possible when an unauthenticated remote attacker sends crafted traffic to the LDAP service in supported versions 12.2.1.4.0 and 14.1.2.1.0 of this Oracle Fusion Middleware component. The maximum CVSS 3.1 base score of 10.0 reflects full confidentiality, integrity, and availability loss plus a scope change that can significantly impact adjacent products. No public exploit identified at time of analysis, and the CVE is not listed in CISA KEV.
Unauthorized data access in Oracle Unified Directory (OUD Core) 12.2.1.4.0 and 14.1.2.1.0 lets a remote unauthenticated attacker reach critical directory data over HTTP, with a scope change that can spill impact into other products relying on the directory. Oracle rates it CVSS 3.1 8.6 with high confidentiality impact and no integrity or availability effect, and tags it as an authentication bypass. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Oracle Unified Directory versions 12.2.1.4.0 and 14.1.2.1.0 expose a network-exploitable authentication bypass over LDAP that grants low-privileged attackers full read and write control over directory data. Despite a moderate CVSS base score of 6.8 driven down by high attack complexity (AC:H), successful exploitation yields complete confidentiality and integrity compromise of all OUD-accessible data - a severe outcome for identity and directory infrastructure. No public exploit code or active exploitation has been identified at time of analysis; Oracle disclosed the issue as part of the Critical Patch Update for August 2026.
Vulnerability in the Oracle Unified Directory product of Oracle Fusion Middleware (component: Security). Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, low attack complexity.
In Eclipse Jetty version 7.x, 8.x, 9.2.27 and older, 9.3.26 and older, and 9.4.16 and older, the server running on any OS and Jetty version combination will reveal the configured fully qualified. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
In Eclipse Jetty version 9.2.27, 9.3.26, and 9.4.16, the server running on Windows is vulnerable to exposure of the fully qualified Base Resource directory name on Windows to a remote client when it. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Oracle Unified Directory (OUD) versions 12.2.1.4.0 and 14.1.2.1.0 expose a network-accessible LDAP authorization bypass that enables a low-privileged authenticated attacker to gain unauthorized access to critical or complete directory data. Intelligence sources tag this as an authentication bypass in the OUD Core component, with confirmed scope change impact on additional Oracle Fusion Middleware products consuming OUD identity data. No active exploitation confirmed at time of analysis and no public exploit code has been identified; however, the low attack complexity and network accessibility make this a credible priority for Oracle Fusion Middleware environments.
Unauthenticated remote disclosure of all Oracle Unified Directory data is possible via the LDAP protocol in versions 12.2.1.4.0 and 14.1.2.1.0 of Oracle Unified Directory (Oracle Fusion Middleware). The 'Authentication Bypass' tag and a CVSS vector of AV:N/AC:L/PR:N/UI:N confirm that a network-accessible attacker with no credentials can exploit the OUD Core component to read critical or complete directory data. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and zero-privilege requirement make this a straightforward target for opportunistic scanning.
Unauthenticated remote data exposure in Oracle Unified Directory allows attackers with network access via LDAP to read all directory-accessible data without credentials. Affected versions 12.2.1.4.0 and 14.1.2.1.0 of this Fusion Middleware identity store component are vulnerable to what Oracle and ENISA tag as an authentication bypass. With a CVSS 3.1 score of 7.5 and an AV:N/AC:L/PR:N/UI:N vector, exploitation is considered trivial for any attacker with network reach to the LDAP service port. No public exploit code or CISA KEV listing has been identified at time of analysis, but the unauthenticated attack surface makes this a high-priority patch target for organizations running OUD as a directory backend.
Unauthenticated confidentiality breach in Oracle Unified Directory (OUD Core) exposes all directory-accessible data via LDAP. Both supported releases - 12.2.1.4.0 and 14.1.2.1.0 - are affected, confirming this is not a legacy-only issue. The 'Authentication Bypass' tag combined with a PR:N/AV:N CVSS vector indicates attackers can read sensitive directory contents without credentials over the network; no public exploit or CISA KEV listing has been identified at time of analysis.
Full takeover of Oracle Unified Directory (OUD) 12.2.1.4.0 and 14.1.2.1.0 is achievable by a low-privileged attacker with LDAP network access exploiting a flaw in the OUD Core component. The CVSS scope-change indicator (S:C) confirms that successful exploitation extends beyond the directory service itself, potentially compromising dependent Oracle Fusion Middleware applications that rely on OUD for identity and authentication services. No public exploit code or CISA KEV listing has been identified at time of analysis, though Oracle has acknowledged and addressed the issue in its August 2026 Critical Security Update.
Full takeover of Oracle Unified Directory 12.2.1.4.0 and 14.1.2.1.0 is achievable by a low-privileged network attacker via LDAP, resulting in complete compromise of confidentiality, integrity, and availability of the directory service. The CVSS Scope:Changed indicator confirms that successful exploitation can cascade into additional Oracle Fusion Middleware components that depend on OUD for authentication or directory services, amplifying the blast radius beyond the directory itself. No public exploit code or CISA KEV listing has been identified at time of analysis, but the catastrophic impact profile and identity-backbone role of LDAP directories make this a high-priority patching target under Oracle's August 2026 Critical Patch Update.
Data compromise in Oracle Unified Directory 12.2.1.4.0 and 14.1.2.1.0 (OUD Core component of Oracle Fusion Middleware) allows a low-privileged, network-adjacent attacker to read, create, delete, or modify all directory-accessible data over LDAP. Rated CVSS 3.1 8.1 with high confidentiality and integrity impact but no availability impact, the flaw is described by Oracle as 'easily exploitable' and is tagged as an authentication-bypass class issue. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Takeover of Oracle Unified Directory is possible in Oracle Fusion Middleware versions 12.2.1.4.0 and 14.1.2.1.0 (OUD Core component), where a high-privileged attacker with network access via LDAP can fully compromise the directory service. Oracle rates this CVSS 7.2 with high confidentiality, integrity, and availability impact, and describes it as 'easily exploitable' once the required privileges are held. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, so risk is gated primarily by the authentication requirement.
Data tampering and denial-of-service in Oracle Unified Directory (OUD Core component) let a high-privileged, network-adjacent attacker abuse the LDAP interface to modify or destroy directory data and force a complete crash or hang of the service. Affected supported versions are 12.2.1.4.0 and 14.1.2.1.0, addressed in the Oracle July 2026 Critical Patch Update. The flaw carries a scope change, meaning a successful attack can significantly impact products beyond OUD itself. No public exploit has been identified at time of analysis.
Denial of service in Oracle Unified Directory (OUD Core) versions 12.2.1.4.0 and 14.1.2.1.0 lets an unauthenticated attacker with LDAP network access hang or repeatedly crash the directory server, producing a complete availability outage. Oracle rates it CVSS 3.1 7.5 with availability-only impact and describes it as easily exploitable. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; confidentiality and integrity are unaffected.
Full compromise of Oracle Unified Directory (OUD Core component of Oracle Fusion Middleware) is possible when a low-privileged attacker sends malicious traffic over LDAP to affected versions 12.2.1.4.0 and 14.1.2.1.0. Oracle rates this 8.8 (CVSS 3.1) and characterizes it as 'easily exploitable,' with successful attacks resulting in complete takeover of the directory server, breaching confidentiality, integrity, and availability. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and network-facing LDAP interface make it a high-priority patch item.
Full takeover of Oracle Unified Directory is possible in the OUD Core component of Oracle Fusion Middleware versions 12.2.1.4.0 and 14.1.2.1.0, where a low-privileged attacker with LDAP network access can compromise the directory service and, because of a scope change, significantly impact additional connected products. Oracle rates this CVSS 9.9 and lists it in the July 2026 Critical Patch Update; there is no public exploit identified at time of analysis and it is not on CISA KEV. The combination of low attack complexity, only low privileges required, and cross-product blast radius makes this one of the highest-severity fixes in the CPU.
Unauthorized data access in Oracle Unified Directory 12.2.1.4.0 and 14.1.2.1.0 (OUD Core component) lets a remote unauthenticated attacker abuse the LDAP interface to read critical directory data and make limited unauthorized modifications. Rated CVSS 8.2 and flagged by Oracle as easily exploitable, the flaw is tagged as an authentication bypass, meaning directory contents can be reached without valid credentials. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Scope-changing compromise of Oracle Unified Directory (OUD Core) 12.2.1.4.0 and 14.1.2.1.0 lets a remote, unauthenticated attacker abuse the LDAP interface to read and alter all directory-accessible data, tagged by Oracle as an authentication bypass. Because OUD brokers identity and access for downstream Fusion Middleware systems, successful attacks carry a CVSS 3.1 scope change (S:C) and can significantly impact other products beyond the directory itself. No public exploit identified at time of analysis; exploitation is rated high-complexity (AC:H), so this is a serious but non-trivial-to-weaponize flaw addressed in Oracle's July 2026 Critical Patch Update.
Elevation-of-scope compromise in Oracle Unified Directory (Fusion Middleware, OUD Core component) versions 12.2.1.4.0 and 14.1.2.1.0 lets an authenticated low-privileged attacker with LDAP network access read all OUD-accessible data and modify some of it, with a scope change that can significantly impact additional connected products. Oracle rates it CVSS 3.1 8.5, and the source intelligence tags it as an authentication-bypass-class issue. There is no public exploit identified at time of analysis and it is not in CISA KEV, but the low attack complexity and scope change make it a meaningful patch priority for Oracle-integrated identity infrastructure.
Remote denial-of-service in Oracle Unified Directory (OUD Core) 12.2.1.4.0 and 14.1.2.1.0 lets an unauthenticated network attacker send crafted LDAP traffic that hangs or repeatedly crashes the directory service, producing a complete availability outage. Addressed in the Oracle Critical Patch Update of July 2026, the flaw carries CVSS 7.5 (availability-only) with no impact to confidentiality or integrity. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, so exploitation is currently theoretical rather than observed.
Full compromise of Oracle Unified Directory is possible in the OUD Core component of Oracle Fusion Middleware versions 12.2.1.4.0 and 14.1.2.1.0, where a remote attacker interacting over LDAP can take over the directory service and impact other trusting systems due to a scope change. The flaw scores CVSS 9.0 but is rated high attack complexity (AC:H), meaning exploitation is difficult despite requiring no authentication. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Full compromise of Oracle Unified Directory (OUD Core) is possible when a low-privileged attacker with network access sends malicious traffic over LDAP, per the July 2026 Oracle Critical Patch Update. Affected supported releases are 12.2.1.4.0 and 14.1.2.1.0, and Oracle rates the flaw as easily exploitable with a CVSS 3.1 base score of 8.8, resulting in complete takeover of the directory service. No public exploit identified at time of analysis and the CVE is not on CISA KEV, but authenticated LDAP reachability makes it a strong patching priority for exposed directory servers.
Privilege escalation and data compromise in Oracle Unified Directory 14.1.2.1.0 (OUD Core) lets a low-privileged, authenticated attacker with LDAP network access read, create, modify or delete all OUD-accessible data and cause a partial denial of service. Oracle rates it CVSS 9.9 with a scope change, meaning exploitation can significantly impact additional products beyond the directory itself. No public exploit identified at time of analysis and it is not listed in CISA KEV, but the near-maximum score and low attack complexity make it a top patching priority.
Privilege-scoped data compromise in Oracle Unified Directory (OUD Core) 12.2.1.4.0 and 14.1.2.1.0 lets a low-privileged, authenticated attacker with LDAP network access read and modify all directory-accessible data, with a scope change that can significantly impact other integrated products. Rated CVSS 3.1 8.2 (C:H/I:H, no availability impact) and tagged as an authentication-bypass class issue, though the attack is rated hard to execute (AC:H). No public exploit identified at time of analysis and it is not on CISA KEV.
Privilege escalation and cross-product data compromise in Oracle Unified Directory 12.2.1.4.0 and 14.1.2.1.0 (OUD Core) lets a low-privileged network attacker abuse the LDAP interface to gain complete read access to all directory-accessible data and partial write access. Vendor-tagged as an authentication bypass with a scope change, meaning successful attacks can significantly impact other products that rely on this directory. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV, but the CVSS 3.1 base score of 8.5 with 'easily exploitable' vendor language marks it as a high-priority patch.
Takeover of Oracle Unified Directory is possible in the OUD Core component of Oracle Fusion Middleware versions 12.2.1.4.0 and 14.1.2.1.0, where a low-privileged attacker with network access over LDAP can fully compromise the directory service. Rated CVSS 3.1 8.8 with high confidentiality, integrity, and availability impact, Oracle describes the flaw as 'easily exploitable', meaning an authenticated LDAP user can escalate to full control of the directory. No public exploit has been identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and authenticated-user prerequisite make it a high priority for LDAP-exposed deployments.
Privilege-based takeover of Oracle Unified Directory (OUD Core) affects Fusion Middleware versions 12.2.1.4.0 and 14.1.2.1.0, where a high-privileged attacker with LDAP network access can fully compromise the directory service. Successful exploitation yields complete takeover with high confidentiality, integrity, and availability impact (CVSS 3.1 base 7.2). No public exploit identified at time of analysis; addressed in Oracle's July 2026 Critical Patch Update.
Complete takeover of Oracle Unified Directory (OUD Core) is possible when a remote, unauthenticated attacker exploits a flaw reachable over the LDAP protocol in Oracle Fusion Middleware versions 12.2.1.4.0 and 14.1.2.1.0, per Oracle's July 2026 Critical Patch Update. Oracle rates the attack complexity as high, and a successful attack yields full confidentiality, integrity, and availability compromise (CVSS 8.1). There is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV, so exploitation would currently be theoretical or targeted rather than commodity.
Complete takeover of Oracle Unified Directory (OUD Core) is achievable by an unauthenticated, network-based attacker communicating over LDAP against supported versions 12.2.1.4.0 and 14.1.2.1.0. Rated CVSS 3.1 9.8 with full confidentiality, integrity, and availability impact and marked 'easily exploitable' by Oracle, the flaw yields product compromise without credentials or user interaction. No public exploit identified at time of analysis and the issue is not currently listed in CISA KEV, but the trivial exploitation profile makes it a top patching priority.
Privilege escalation to full takeover in Oracle Unified Directory (OUD Core) 12.2.1.4.0 and 14.1.2.1.0 lets a low-privileged attacker with LDAP network access completely compromise the directory service, with a scope change that can significantly impact other connected products. Oracle rates it CVSS 3.1 9.9 with full confidentiality, integrity, and availability loss. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and 'easily exploitable' characterization make this a high-priority patch from the July 2026 Oracle Critical Patch Update.
Complete takeover of Oracle Unified Directory (OUD) is possible when an unauthenticated remote attacker sends crafted traffic to the LDAP service in supported versions 12.2.1.4.0 and 14.1.2.1.0 of this Oracle Fusion Middleware component. The maximum CVSS 3.1 base score of 10.0 reflects full confidentiality, integrity, and availability loss plus a scope change that can significantly impact adjacent products. No public exploit identified at time of analysis, and the CVE is not listed in CISA KEV.
Unauthorized data access in Oracle Unified Directory (OUD Core) 12.2.1.4.0 and 14.1.2.1.0 lets a remote unauthenticated attacker reach critical directory data over HTTP, with a scope change that can spill impact into other products relying on the directory. Oracle rates it CVSS 3.1 8.6 with high confidentiality impact and no integrity or availability effect, and tags it as an authentication bypass. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Oracle Unified Directory versions 12.2.1.4.0 and 14.1.2.1.0 expose a network-exploitable authentication bypass over LDAP that grants low-privileged attackers full read and write control over directory data. Despite a moderate CVSS base score of 6.8 driven down by high attack complexity (AC:H), successful exploitation yields complete confidentiality and integrity compromise of all OUD-accessible data - a severe outcome for identity and directory infrastructure. No public exploit code or active exploitation has been identified at time of analysis; Oracle disclosed the issue as part of the Critical Patch Update for August 2026.
Vulnerability in the Oracle Unified Directory product of Oracle Fusion Middleware (component: Security). Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, low attack complexity.
In Eclipse Jetty version 7.x, 8.x, 9.2.27 and older, 9.3.26 and older, and 9.4.16 and older, the server running on any OS and Jetty version combination will reveal the configured fully qualified. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
In Eclipse Jetty version 9.2.27, 9.3.26, and 9.4.16, the server running on Windows is vulnerable to exposure of the fully qualified Base Resource directory name on Windows to a remote client when it. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.