CVE-2026-60437 is a vulnerability in Oracle Unified Directory (OUD) core component affecting versions 12.2.1.4.0 and 14.1.2.1.0. It allows a high privileged attacker with network access via LDAP to compromise the system. The vulnerability enables unauthorized creation, deletion, or modification of critical data and can cause a hang or repeated crash of the OUD service, resulting in denial of service. The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:H) reflects network attack vector, low attack complexity, high privileges required, no user interaction, scope change, no confidentiality impact, high integrity and availability impacts. The vulnerability may also impact other Oracle products due to shared components or integration. Oracle’s July 2026 Critical Patch Update advisory references multiple security patches but does not explicitly confirm patch availability or remediation status for this CVE. No known exploits in the wild have been reported.

An attacker with high privileges and network access via LDAP can exploit this vulnerability to gain unauthorized ability to create, delete, or modify critical data within Oracle Unified Directory. Additionally, the attacker can cause denial of service by hanging or repeatedly crashing the directory service. The integrity and availability of the affected system are severely impacted. There is no direct confidentiality impact reported. The vulnerability’s scope change means that other Oracle products relying on Oracle Unified Directory may also be affected.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Oracle’s July 2026 Critical Patch Update advisory includes many security patches but does not explicitly state a fix for CVE-2026-60437. Oracle strongly recommends applying all relevant Critical Patch Updates promptly to mitigate known vulnerabilities. Until an official patch is confirmed, restrict network access to Oracle Unified Directory LDAP interfaces to trusted administrators only and monitor for unusual activity involving high privileged accounts.