This vulnerability affects Oracle Unified Directory (OUD) in versions 12.2.1.4.0 and 14.1.2.1.0. It permits a low privileged attacker with network access via LDAP to compromise the system, potentially resulting in full takeover of the Oracle Unified Directory. The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability. The vulnerability is categorized under CWE-269 (Improper Privilege Management). Oracle's July 2026 Critical Patch Update advisory references this vulnerability but does not explicitly confirm patch availability or remediation details for it. The vendor strongly recommends applying security patches promptly, although no direct patch link or fix status is provided for this CVE in the advisory.

Successful exploitation allows an attacker with low privileges and network access via LDAP to fully compromise Oracle Unified Directory, impacting confidentiality, integrity, and availability of the system. This could lead to complete takeover of the affected Oracle Unified Directory instance.

Oracle's July 2026 Critical Patch Update advisory references this vulnerability but does not explicitly confirm patch availability or remediation status for CVE-2026-60419. Customers are strongly advised to review the advisory at https://www.oracle.com/security-alerts/cpujul2026.html and apply all relevant security patches promptly. Until explicit patch information is confirmed, organizations should consider restricting LDAP network access to trusted sources and monitor for unusual activity related to Oracle Unified Directory. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.