This vulnerability affects Oracle Unified Directory (OUD) versions 12.2.1.4.0 and 14.1.2.1.0 and allows an unauthenticated attacker with network access via LDAP to compromise the system. The attacker can perform unauthorized creation, deletion, or modification of critical or accessible data, gain unauthorized read access to some data, and cause a partial denial of service. The CVSS 3.1 vector indicates network attack vector, low attack complexity, no privileges or user interaction required, and impacts confidentiality (low), integrity (high), and availability (low). Oracle has addressed this vulnerability in its June 2026 Critical Security Patch Update. Customers are strongly advised to apply the patch immediately to mitigate the risk. Until patched, risk reduction may be possible by blocking required network protocols or removing unnecessary privileges, though these may disrupt functionality.

An unauthenticated attacker with network access via LDAP can exploit this vulnerability to gain unauthorized creation, deletion, or modification access to critical or all accessible data in Oracle Unified Directory. The attacker can also read some data without authorization and cause a partial denial of service. This impacts confidentiality, integrity, and availability of the affected system, with integrity impact rated high and confidentiality and availability impacts rated low.

Oracle has released a security patch for this vulnerability as part of the June 2026 Critical Security Patch Update. Customers should apply this patch promptly to remediate the vulnerability. Until the patch is applied, risk may be reduced by blocking network protocols required for exploitation or removing unnecessary privileges from users, but these measures may affect application functionality. Oracle strongly recommends remaining on actively supported versions and applying security patches without delay.