This vulnerability affects Oracle Unified Directory (OUD) in Oracle Fusion Middleware, specifically versions 12.2.1.4.0 and 14.1.2.1.0. An unauthenticated attacker with network access via LDAP can exploit this difficult-to-exploit vulnerability to gain unauthorized creation, deletion, or modification access to critical data or all data accessible through Oracle Unified Directory. The vulnerability has a scope change, meaning it may affect additional Oracle products beyond OUD. The CVSS 3.1 vector is AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N, indicating network attack vector, high attack complexity, no privileges or user interaction required, scope changed, and high confidentiality and integrity impacts without availability impact. No official patch or remediation level is stated in the advisory, and no known exploits in the wild have been reported as of the publication date. Oracle's Critical Patch Update advisory for July 2026 references this vulnerability but does not explicitly confirm patch availability for it yet.

Successful exploitation allows unauthorized creation, deletion, or modification of critical data within Oracle Unified Directory, compromising confidentiality and integrity of data. The vulnerability may also impact additional Oracle products due to scope change. There is no reported impact on system availability. The CVSS score of 8.7 reflects a high-severity impact on confidentiality and integrity.

Patch status is not yet confirmed — check the Oracle Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle strongly recommends applying security patches promptly once available and remaining on actively supported versions. Until a patch is confirmed, restrict network access to Oracle Unified Directory LDAP services to trusted sources and monitor for unusual activity related to LDAP access.