CVE-2026-60422: Easily exploitable vulnerability allows low privileged attacker with network access via LDAP to compromise Oracle Unified Directory. While the vulnerability is in Oracle Unified Directory, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Unified Directory accessible data as well as unauthorized access to critical data
Vulnerability in the Oracle Unified Directory product of Oracle Fusion Middleware (component: OUD Core). The supported version that is affected is 14.1.2.1.0. Easily exploitable vulnerability allows low privileged attacker with network access via LDAP to compromise Oracle Unified Directory. While the vulnerability is in Oracle Unified Directory, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Unified Directory accessible data as well as unauthorized access to critical data or complete access to all Oracle Unified Directory accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Unified Directory. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L).
AI Analysis
Technical Summary
This vulnerability affects Oracle Unified Directory version 14.1.2.1.0 and allows a low privileged attacker with network access via LDAP to compromise the system. Successful exploitation can result in unauthorized creation, deletion, or modification of critical data, unauthorized access to all data accessible by Oracle Unified Directory, and the ability to cause a partial denial of service. The vulnerability is classified under CWE-284 (Improper Access Control) and has a CVSS 3.1 score of 9.9 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L), indicating it is remotely exploitable with low attack complexity and no user interaction required. The vendor advisory from Oracle (https://www.oracle.com/security-alerts/cpujul2026.html) does not explicitly confirm patch availability for this specific vulnerability but advises applying Critical Patch Updates without delay. The vulnerability may also affect other Oracle products due to scope change.
Potential Impact
Exploitation of this vulnerability can lead to unauthorized creation, deletion, or modification of critical data within Oracle Unified Directory, unauthorized access to all data accessible by the directory, and partial denial of service conditions. The confidentiality, integrity, and availability of the affected system are severely impacted. The vulnerability allows a low privileged attacker with network access to escalate privileges and compromise the system.
Mitigation Recommendations
Oracle has released a Critical Patch Update in July 2026 that addresses multiple vulnerabilities, including those affecting Oracle Unified Directory. Although the vendor advisory does not explicitly confirm a specific patch for CVE-2026-60422, Oracle strongly recommends that customers remain on actively supported versions and apply all security patches promptly to mitigate this vulnerability. Users of Oracle Unified Directory 14.1.2.1.0 should monitor the Oracle Critical Patch Update advisory and apply relevant patches as soon as they become available. Patch status is not yet confirmed explicitly for this CVE; check the vendor advisory for current remediation guidance.
CVE-2026-60422: Easily exploitable vulnerability allows low privileged attacker with network access via LDAP to compromise Oracle Unified Directory. While the vulnerability is in Oracle Unified Directory, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Unified Directory accessible data as well as unauthorized access to critical data
Description
Vulnerability in the Oracle Unified Directory product of Oracle Fusion Middleware (component: OUD Core). The supported version that is affected is 14.1.2.1.0. Easily exploitable vulnerability allows low privileged attacker with network access via LDAP to compromise Oracle Unified Directory. While the vulnerability is in Oracle Unified Directory, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Unified Directory accessible data as well as unauthorized access to critical data or complete access to all Oracle Unified Directory accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Unified Directory. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L).
CVSS v3.1
Score 9.9critical
Affected software
pkg:maven/com.oracle.directory/oracle-unified-directoryRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability affects Oracle Unified Directory version 14.1.2.1.0 and allows a low privileged attacker with network access via LDAP to compromise the system. Successful exploitation can result in unauthorized creation, deletion, or modification of critical data, unauthorized access to all data accessible by Oracle Unified Directory, and the ability to cause a partial denial of service. The vulnerability is classified under CWE-284 (Improper Access Control) and has a CVSS 3.1 score of 9.9 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L), indicating it is remotely exploitable with low attack complexity and no user interaction required. The vendor advisory from Oracle (https://www.oracle.com/security-alerts/cpujul2026.html) does not explicitly confirm patch availability for this specific vulnerability but advises applying Critical Patch Updates without delay. The vulnerability may also affect other Oracle products due to scope change.
Potential Impact
Exploitation of this vulnerability can lead to unauthorized creation, deletion, or modification of critical data within Oracle Unified Directory, unauthorized access to all data accessible by the directory, and partial denial of service conditions. The confidentiality, integrity, and availability of the affected system are severely impacted. The vulnerability allows a low privileged attacker with network access to escalate privileges and compromise the system.
Mitigation Recommendations
Oracle has released a Critical Patch Update in July 2026 that addresses multiple vulnerabilities, including those affecting Oracle Unified Directory. Although the vendor advisory does not explicitly confirm a specific patch for CVE-2026-60422, Oracle strongly recommends that customers remain on actively supported versions and apply all security patches promptly to mitigate this vulnerability. Users of Oracle Unified Directory 14.1.2.1.0 should monitor the Oracle Critical Patch Update advisory and apply relevant patches as soon as they become available. Patch status is not yet confirmed explicitly for this CVE; check the vendor advisory for current remediation guidance.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- oracle
- Date Reserved
- 2026-07-08T15:51:40.536Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
- Vendor Advisory Urls
- [{"url":"https://www.oracle.com/security-alerts/cpujul2026.html","vendor":"Oracle"}]
Threat ID: 6a5fede79c2644c7f8d5910b
Added to database: 07/21/2026, 22:08:39 UTC
Last enriched: 07/29/2026, 21:40:38 UTC
Last updated: 09/03/2026, 22:52:13 UTC
Views: 55
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.