This vulnerability affects Oracle Unified Directory (OUD) versions 12.2.1.4.0 and 14.1.2.1.0 and allows an unauthenticated attacker with network access via the Remote Method Invocation (RMI) protocol to compromise the product. Successful exploitation can lead to full takeover of Oracle Unified Directory, impacting confidentiality, integrity, and availability. The CVSS 3.1 score is 9.8, reflecting the critical nature of this flaw. Oracle's June 2026 Critical Security Patch Update includes fixes for this vulnerability among 245 other security patches. The vendor strongly recommends applying these patches immediately. Until patched, risk reduction may be possible by blocking network protocols used in the attack or restricting privileges, though these measures may affect normal operations.

The vulnerability allows unauthenticated remote attackers to fully compromise Oracle Unified Directory, leading to complete takeover of the system. This impacts confidentiality, integrity, and availability of the affected product, as reflected by the CVSS 3.1 score of 9.8. Such a compromise could allow attackers to access sensitive data, modify or disrupt directory services, and potentially pivot to other systems relying on Oracle Unified Directory.

Oracle has released a Critical Security Patch Update in June 2026 that addresses this vulnerability. Customers should apply the official patches from this update without delay. Until patches are applied, risk can be partially mitigated by blocking network protocols required for exploitation (such as RMI) and by removing unnecessary privileges or access to vulnerable components from users who do not require them. Oracle strongly recommends staying on actively supported versions and applying security patches promptly to prevent exploitation.