This vulnerability exists in the Oracle Unified Directory component of Oracle Fusion Middleware. It is easily exploitable by an attacker with low privileges and network access through LDAP. Successful exploitation can lead to complete compromise of Oracle Unified Directory, affecting confidentiality, integrity, and availability. The vulnerability also has a scope change, meaning it can impact other Oracle products beyond Unified Directory. The CVSS 3.1 base score is 9.9, reflecting critical severity. Affected versions explicitly include 12.2.1.4.0 and 14.1.2.1.0. Oracle's July 2026 Critical Patch Update advisory references this vulnerability among many others and urges customers to apply patches without delay.

Exploitation of this vulnerability can result in full takeover of Oracle Unified Directory, compromising confidentiality, integrity, and availability of the system. Due to scope change, other Oracle products dependent on or integrated with Oracle Unified Directory may also be significantly impacted. The vulnerability is remotely exploitable over the network via LDAP by a low privileged attacker without user interaction.

Oracle has included this vulnerability in its July 2026 Critical Patch Update advisory. Customers should review the advisory at https://www.oracle.com/security-alerts/cpujul2026.html and apply the relevant security patches promptly. Oracle strongly recommends remaining on actively supported versions and applying security patches without delay to prevent exploitation. Patch status is not explicitly stated for this vulnerability alone, but it is part of the cumulative Critical Patch Update. Therefore, remediation is available through Oracle's official patches.