This vulnerability affects Oracle Unified Directory (OUD) versions 12.2.1.4.0 and 14.1.2.1.0 and allows an unauthenticated attacker with network access via Remote Method Invocation (RMI) to compromise the system. The flaw is easily exploitable and can lead to full takeover of the Oracle Unified Directory product. The CVSS 3.1 score is 9.8, reflecting critical severity with high impact on confidentiality, integrity, and availability. Oracle has included fixes for this vulnerability in its June 2026 Critical Security Patch Update (CSPU). The vendor strongly recommends applying these patches immediately. Until patched, risk can be partially mitigated by blocking network protocols used in exploitation and restricting unnecessary privileges, though these measures may affect normal operations.

Successful exploitation allows unauthenticated remote attackers to fully compromise Oracle Unified Directory, resulting in complete loss of confidentiality, integrity, and availability of the affected system. This can lead to total takeover of the directory service, potentially impacting dependent applications and services.

Oracle has released a Critical Security Patch Update in June 2026 that addresses this vulnerability. Customers should apply the provided security patches without delay. Until patches are applied, risk may be reduced by blocking network protocols required for exploitation (such as RMI) and removing unnecessary privileges from users. However, these mitigations may disrupt normal application functionality. Oracle strongly recommends staying on actively supported versions and promptly applying all security updates. Patch status is confirmed by the vendor advisory linked.