This vulnerability affects Oracle Unified Directory (OUD) in versions 12.2.1.4.0 and 14.1.2.1.0. It permits an unauthenticated attacker with network access via LDAP to cause a hang or a frequently repeatable crash, resulting in a complete denial of service (DoS). The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, reflecting network attack vector, low attack complexity, no privileges or user interaction required, unchanged scope, no confidentiality or integrity impact, and high availability impact. The vulnerability is categorized under CWE-400 (Uncontrolled Resource Consumption). No known exploits in the wild have been reported. The vendor advisory from Oracle (https://www.oracle.com/security-alerts/cpujul2026.html) does not explicitly confirm patch availability or remediation status for this specific vulnerability but recommends applying Critical Patch Updates promptly.

Successful exploitation allows an unauthenticated attacker to cause Oracle Unified Directory to hang or crash repeatedly, resulting in a complete denial of service. There is no impact on confidentiality or integrity, but availability is severely affected.

Oracle's Critical Patch Update advisory for July 2026 recommends that customers apply security patches without delay to address vulnerabilities including this one. However, the advisory does not explicitly confirm a patch for CVE-2026-60425 at this time. Patch status is not yet confirmed — check the vendor advisory (https://www.oracle.com/security-alerts/cpujul2026.html) for current remediation guidance. Until a patch is applied, limiting network access to the LDAP service and monitoring for unusual availability issues may help reduce risk.