CVE-2026-60423 affects Oracle Unified Directory (OUD) versions 12.2.1.4.0 and 14.1.2.1.0. It is an easily exploitable vulnerability that permits a low privileged attacker with network access via LDAP to compromise the OUD product. Successful exploitation can lead to complete takeover of Oracle Unified Directory, impacting confidentiality, integrity, and availability. The vulnerability is tracked under CWE-287 (Improper Authentication). Oracle's July 2026 Critical Patch Update advisory references multiple security patches but does not explicitly confirm the patch availability or remediation level for this specific CVE. Customers are advised to review the advisory and apply patches without delay.

The vulnerability allows an attacker with low privileges and network access via LDAP to fully compromise Oracle Unified Directory, resulting in complete takeover. This impacts confidentiality, integrity, and availability of the affected system. No known exploits in the wild have been reported to date.

Oracle has released a Critical Patch Update advisory in July 2026 addressing multiple vulnerabilities including those in Oracle Unified Directory. However, the specific patch status for CVE-2026-60423 is not explicitly confirmed in the advisory content provided. Customers should consult the official Oracle advisory at https://www.oracle.com/security-alerts/cpujul2026.html for the latest patch availability and apply relevant security updates promptly. Maintaining actively supported versions and timely patching is strongly recommended by Oracle to mitigate this vulnerability.