This vulnerability exists in the Oracle Unified Directory component of Oracle Fusion Middleware. It permits an unauthenticated attacker with network access via LDAP to compromise the Oracle Unified Directory, potentially resulting in complete takeover. The vulnerability affects versions 12.2.1.4.0 and 14.1.2.1.0. The CVSS 3.1 base score is 9.0, indicating critical severity with high impacts on confidentiality, integrity, and availability. The attack complexity is high, and no privileges or user interaction are required. The vulnerability also has a scope change, meaning successful exploitation may impact additional Oracle products. Oracle's July 2026 Critical Patch Update advisory references this vulnerability but does not explicitly state patch availability or remediation details for these specific versions.

Successful exploitation can lead to full compromise of Oracle Unified Directory, affecting confidentiality, integrity, and availability of the system. Due to scope change, other Oracle products relying on Oracle Unified Directory may also be significantly impacted. The vulnerability allows unauthenticated network attackers to gain control, posing a critical risk to affected environments.

Oracle has published a Critical Patch Update advisory in July 2026 that addresses multiple vulnerabilities including this one. However, the advisory does not explicitly confirm patch availability for the affected Oracle Unified Directory versions 12.2.1.4.0 and 14.1.2.1.0. Customers should review the Oracle Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for the latest patch and remediation information. Oracle strongly recommends applying available security patches promptly and remaining on actively supported versions. Patch status for this specific vulnerability is not yet confirmed in the advisory content provided; therefore, check the vendor advisory for current remediation guidance.