This vulnerability affects Oracle Unified Directory (OUD) in versions 12.2.1.4.0 and 14.1.2.1.0. It is an easily exploitable flaw that allows unauthenticated attackers with network access via LDAP to compromise the OUD product, potentially leading to full system takeover. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) reflects that no privileges or user interaction are required, and the impact is high across confidentiality, integrity, and availability. Oracle's June 2026 Critical Security Patch Update includes fixes for this vulnerability among 245 other patches. The vendor strongly recommends applying these patches immediately to prevent exploitation.

Successful exploitation of this vulnerability can lead to complete compromise of Oracle Unified Directory, affecting confidentiality, integrity, and availability of the system. An unauthenticated attacker with network access via LDAP can take over the product, which may result in unauthorized data access, modification, or denial of service.

Oracle has released a Critical Security Patch Update in June 2026 that addresses this vulnerability. Customers should apply the security patches from this update without delay. Until patches are applied, risk may be reduced by blocking network protocols required for the attack or by removing unnecessary privileges from users, though these measures may impact functionality. Oracle strongly advises staying on actively supported versions and promptly applying security updates as detailed in the vendor advisory: https://www.oracle.com/security-alerts/cspujun2026.html