CVE-2026-46776 is a vulnerability in Oracle Unified Directory (OUD) affecting versions 12.2.1.4.0 and 14.1.2.1.0. It permits an unauthenticated attacker with network access via LDAP to compromise the system, resulting in unauthorized creation, deletion, or modification of critical or accessible data, unauthorized read access to some data, and the ability to cause a partial denial of service. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L) indicates network attack vector, low attack complexity, no privileges or user interaction required, and impacts confidentiality, integrity, and availability. Oracle's June 2026 Critical Security Patch Update advisory references this vulnerability among 245 security patches but does not explicitly state patch availability or remediation level for this CVE. Oracle strongly urges customers to apply the Critical Security Patch Update without delay and to remain on actively supported versions. Workarounds include blocking network protocols required for the attack or removing unnecessary privileges, though these may affect application functionality.

Successful exploitation allows unauthenticated attackers to create, delete, or modify critical data or all data accessible via Oracle Unified Directory, read a subset of accessible data without authorization, and cause a partial denial of service. This impacts confidentiality, integrity, and availability of the affected system. The CVSS 3.1 base score of 8.6 reflects a high severity with network attack vector and no authentication required.

Oracle's June 2026 Critical Security Patch Update advisory strongly recommends applying the provided security patches as soon as possible to address this vulnerability. Although the advisory does not explicitly confirm patch availability for CVE-2026-46776, it is included in the update containing 245 security patches. Until patches are applied, risk may be reduced by blocking network protocols required for LDAP access or by removing unnecessary privileges from users, but these measures may disrupt application functionality. Customers should consult the Oracle advisory at https://www.oracle.com/security-alerts/cspujun2026.html for detailed patch availability and installation instructions.