This vulnerability affects Oracle Unified Directory (OUD) versions 12.2.1.4.0 and 14.1.2.1.0 and involves a difficult to exploit flaw that allows a low privileged attacker with network access via LDAP to compromise the system. Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data within OUD, as well as unauthorized access to all data accessible by OUD. The vulnerability has a CVSS 3.1 score of 8.2 with high confidentiality and integrity impacts and a scope change indicating potential impact on additional Oracle products. The vendor advisory from Oracle (July 2026 Critical Patch Update) does not explicitly confirm the availability of a patch for this specific vulnerability but strongly recommends applying all relevant security patches from the Critical Patch Update. No known exploits in the wild have been reported.

Successful exploitation of CVE-2026-60421 can result in unauthorized creation, deletion, or modification of critical data within Oracle Unified Directory, as well as unauthorized access to all data accessible by the directory. This compromises confidentiality and integrity of the data but does not impact availability. The vulnerability also has a scope change, meaning it may affect additional Oracle products that rely on Oracle Unified Directory.

Patch status is not yet confirmed — check the Oracle Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle strongly recommends that customers remain on actively-supported versions and apply security patches without delay as part of their Critical Patch Update process. No specific temporary mitigations or workarounds are provided in the advisory.