This vulnerability in Oracle Unified Directory (OUD) allows an attacker with low privileges and network access via LDAP to compromise the system. The CVSS 3.1 base score is 8.5, indicating high impact on confidentiality, integrity, and availability. Successful exploitation can result in full takeover of OUD, and due to scope change, other Oracle products may also be impacted. The affected versions are 12.2.1.4.0 and 14.1.2.1.0. Oracle has included a fix for this vulnerability in its August 2026 Critical Security Patch Update, which contains 943 security patches across multiple products.

Successful exploitation can lead to complete compromise of Oracle Unified Directory, affecting confidentiality, integrity, and availability of the system. The vulnerability's scope change means that other Oracle products relying on OUD may also be impacted. This could allow attackers to gain unauthorized control over directory services and potentially escalate access within affected environments.

Oracle has released a Critical Security Patch Update in August 2026 that addresses this vulnerability among others. Customers are strongly advised to apply the available patches promptly to mitigate the risk. Oracle recommends staying on actively-supported versions and applying security patches without delay. No alternative mitigations or temporary fixes are indicated in the advisory.