CVE-2026-60360 is a vulnerability in Oracle Unified Directory (OUD) component of Oracle Fusion Middleware that affects versions 12.2.1.4.0 and 14.1.2.1.0. It allows an unauthenticated attacker with network access via LDAP to compromise the OUD product, potentially leading to full takeover. The vulnerability has a CVSS 3.1 score of 10.0, reflecting critical impact on confidentiality, integrity, and availability. The vulnerability also has scope change implications, meaning exploitation may affect additional Oracle products. Oracle's July 2026 Critical Patch Update advisory references multiple patches but does not explicitly confirm a patch for this specific CVE in the provided content. Customers are strongly advised to review Oracle's advisory and apply relevant patches promptly.

Successful exploitation of this vulnerability allows an unauthenticated attacker with network access via LDAP to take over Oracle Unified Directory, compromising confidentiality, integrity, and availability of the system. Due to scope change, other Oracle products dependent on or integrated with Oracle Unified Directory may also be significantly impacted.

Oracle has released a Critical Patch Update advisory in July 2026 that addresses multiple security vulnerabilities. Customers should consult the advisory at https://www.oracle.com/security-alerts/cpujul2026.html for patch availability and installation instructions. Patch status for CVE-2026-60360 is not explicitly confirmed in the advisory content provided; therefore, customers should verify the current patch status and apply all relevant updates without delay. Oracle strongly recommends remaining on actively supported versions and promptly applying security patches to mitigate this vulnerability.