This vulnerability affects Oracle Unified Directory (OUD) components in Oracle Fusion Middleware, specifically versions 12.2.1.4.0 and 14.1.2.1.0. It is an easily exploitable vulnerability that allows an attacker with low privileges and network access via LDAP to compromise the OUD system. The vulnerability has a CVSS 3.1 base score of 9.9, indicating critical impact on confidentiality, integrity, and availability, and the scope of impact extends beyond OUD to other Oracle products. The CWE classification is CWE-306 (Missing Authentication for Critical Function). Oracle's Critical Patch Update advisory for July 2026 references this vulnerability but does not explicitly confirm patch availability or remediation level for it.

Successful exploitation can lead to complete takeover of Oracle Unified Directory, compromising confidentiality, integrity, and availability of the system. Due to scope change, other Oracle products relying on OUD may also be significantly impacted. The vulnerability is network accessible via LDAP and requires only low privileges, increasing the risk of exploitation in affected environments.

Oracle has included this vulnerability in its July 2026 Critical Patch Update advisory. However, the advisory does not explicitly confirm a dedicated patch or remediation level for CVE-2026-60361. Customers are strongly advised to review the July 2026 Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html and apply all relevant patches promptly. Maintaining actively supported versions and timely patch application is critical. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.