This vulnerability affects Oracle Unified Directory (OUD) in versions 12.2.1.4.0 and 14.1.2.1.0. It is an easily exploitable flaw that allows a low privileged attacker with network access via LDAP to gain unauthorized capabilities to create, delete, or modify critical data within OUD. The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high confidentiality and integrity impacts. The vulnerability is categorized under CWE-284 (Improper Access Control). Oracle's July 2026 Critical Patch Update advisory references multiple patches but does not explicitly confirm patch availability or remediation level for this specific CVE. Users are advised to review the advisory and apply relevant patches promptly.

Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data or all data accessible via Oracle Unified Directory. This results in a high impact on confidentiality and integrity of the data managed by OUD. Availability is not impacted. The vulnerability allows an attacker with low privileges and network access to escalate their capabilities significantly within the affected system.

Oracle has published a Critical Patch Update advisory in July 2026 that addresses numerous vulnerabilities across Oracle products, including Oracle Unified Directory. However, the advisory does not explicitly confirm the availability of a patch or remediation level for CVE-2026-60520. Therefore, patch status is not yet confirmed—users should consult the Oracle advisory at https://www.oracle.com/security-alerts/cpujul2026.html for the latest patch availability and installation instructions. Oracle strongly recommends applying security patches without delay and remaining on actively supported versions. Until patches are confirmed and applied, restrict network access to LDAP services and monitor for unusual activity related to Oracle Unified Directory.