This vulnerability affects Oracle Unified Directory (OUD) in versions 12.2.1.4.0 and 14.1.2.1.0. It is an easily exploitable issue that permits unauthenticated attackers with network access through LDAP to compromise the product. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) reflects that no privileges or user interaction are required, and the attack can be performed remotely, resulting in full confidentiality, integrity, and availability compromise. The vulnerability is tracked as CWE-306 (Missing Authentication for Critical Function). Oracle has published a Critical Patch Update advisory in July 2026 addressing multiple vulnerabilities, including this one, but no explicit patch link or remediation level is provided in the data. The vendor strongly recommends applying available patches promptly.

The vulnerability allows an unauthenticated remote attacker to completely take over Oracle Unified Directory, impacting confidentiality, integrity, and availability of the system. This can lead to unauthorized access, data compromise, and disruption of directory services.

Oracle has released a Critical Patch Update in July 2026 that addresses this vulnerability among others. Customers should review the Oracle advisory at https://www.oracle.com/security-alerts/cpujul2026.html and apply the relevant security patches without delay. Since no specific patch link or remediation level is provided, users must verify patch availability and installation instructions from the vendor advisory. No indication of 'no action required' or 'already mitigated' is present, so patching is the recommended mitigation.