CVE-2026-60426 affects Oracle Unified Directory (OUD) versions 12.2.1.4.0 and 14.1.2.1.0. It is an easily exploitable vulnerability that permits a low privileged attacker with network access via LDAP to compromise the OUD product. Successful exploitation can result in unauthorized access to critical data or full access to all data accessible via Oracle Unified Directory, as well as unauthorized update, insert, or delete operations on some data. The vulnerability impacts confidentiality and integrity but not availability, with a CVSS 3.1 score of 8.5 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N). The vulnerability is classified under CWE-284 (Improper Access Control). Oracle's July 2026 Critical Patch Update advisory references multiple patches but does not explicitly confirm a patch or remediation status for this vulnerability. No known exploits in the wild have been reported.

Exploitation of this vulnerability can lead to unauthorized access to sensitive or critical data within Oracle Unified Directory and unauthorized modification (update, insert, delete) of some data. This compromises confidentiality and integrity of the data managed by Oracle Unified Directory. The vulnerability may also affect additional Oracle products due to scope change. There is no impact on availability reported. The CVSS score of 8.5 reflects a high severity impact primarily on confidentiality and integrity.

Oracle has released a Critical Patch Update advisory in July 2026 covering multiple vulnerabilities across Oracle products. Customers are strongly advised to review the advisory at https://www.oracle.com/security-alerts/cpujul2026.html and apply the relevant patches promptly. The advisory does not explicitly confirm the patch status for CVE-2026-60426, so patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until patches are applied, restrict network access to Oracle Unified Directory LDAP interfaces to trusted users only to reduce exposure.