CVE-2026-60420 affects Oracle Unified Directory (OUD) in versions 12.2.1.4.0 and 14.1.2.1.0. It is an easily exploitable vulnerability that allows a low privileged attacker with network access via LDAP to compromise the OUD product. Successful exploitation can lead to unauthorized access to all data accessible by Oracle Unified Directory and unauthorized modification (update, insert, delete) of some data. The vulnerability has a CVSS 3.1 score of 8.5, indicating high severity with significant confidentiality and integrity impacts. The vulnerability also has scope change implications, potentially impacting additional Oracle products that rely on OUD. Oracle's July 2026 Critical Patch Update advisory references multiple patches but does not explicitly confirm a patch for this specific vulnerability. The advisory urges customers to apply patches promptly but does not provide a direct remediation status for CVE-2026-60420.

Exploitation of this vulnerability can result in unauthorized access to critical data within Oracle Unified Directory and unauthorized modification of some data. The confidentiality impact is high, and integrity impact is low, with no impact on availability. The vulnerability affects the security posture of Oracle Unified Directory and potentially other Oracle products that depend on it due to scope change. This could lead to significant data compromise and unauthorized data manipulation.

Patch status is not yet confirmed — check the vendor advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle recommends applying Critical Patch Updates promptly to mitigate known vulnerabilities. Until a specific patch is confirmed for CVE-2026-60420, organizations should monitor Oracle advisories and apply updates as they become available. No vendor advisory content indicates that no action is required or that the vulnerability is already mitigated.