This vulnerability affects Oracle Unified Directory (OUD) components in Oracle Fusion Middleware, specifically versions 12.2.1.4.0 and 14.1.2.1.0. It permits an unauthenticated attacker with network access via LDAP to compromise the directory, resulting in unauthorized access to sensitive data. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) reflects that the attack requires no privileges or user interaction, has low attack complexity, and leads to high confidentiality impact. Oracle's advisory for the August 2026 Critical Security Patch Update includes this vulnerability among 943 fixes and urges customers to apply patches without delay to mitigate exploitation risks.

Successful exploitation allows unauthenticated attackers to access critical or all data accessible via Oracle Unified Directory, compromising confidentiality. There is no impact on integrity or availability. This could lead to unauthorized disclosure of sensitive information managed by Oracle Unified Directory.

Oracle has released security patches addressing this vulnerability as part of the August 2026 Critical Security Patch Update. Customers should apply the relevant patches for Oracle Unified Directory versions 12.2.1.4.0 and 14.1.2.1.0 without delay. Oracle strongly recommends remaining on actively supported versions and promptly applying all security updates to prevent exploitation. No alternative mitigations or workarounds are specified in the advisory.