This vulnerability affects Oracle Unified Directory (OUD) in versions 12.2.1.4.0 and 14.1.2.1.0. It is an easily exploitable flaw that permits unauthenticated attackers with network access via LDAP to compromise the system, potentially resulting in full takeover. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) indicates network attack vector, low attack complexity, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability. Oracle's June 2026 Critical Security Patch Update includes patches for this vulnerability. Oracle strongly advises applying these patches immediately to mitigate the risk. Workarounds include blocking network protocols used by the attack and restricting privileges, but these may disrupt normal operations.

The vulnerability allows unauthenticated remote attackers to fully compromise Oracle Unified Directory, impacting confidentiality, integrity, and availability. This can lead to complete takeover of the affected system, enabling attackers to access sensitive data, modify or delete information, and disrupt directory services.

Oracle has released patches for this vulnerability as part of the June 2026 Critical Security Patch Update. Customers are strongly advised to apply these patches without delay. Until patches are applied, risk can be mitigated by blocking network protocols required by the attack and removing unnecessary privileges from users. However, these mitigations may affect application functionality. Patch status is confirmed by the vendor advisory. No indication of cloud service applicability; this is an on-premises product.