This vulnerability affects Oracle Unified Directory (OUD) versions 12.2.1.4.0 and 14.1.2.1.0 and involves a security flaw that can be exploited by an attacker with low privileges and network access via LDAP. Successful exploitation allows unauthorized creation, deletion, or modification of critical data or complete access to all data accessible by OUD. The CVSS 3.1 vector indicates network attack vector, high attack complexity, low privileges required, no user interaction, unchanged scope, and high confidentiality and integrity impacts without availability impact. Oracle has addressed this vulnerability in its August 2026 Critical Security Patch Update, which customers are strongly advised to apply promptly.

If exploited, this vulnerability can lead to unauthorized creation, deletion, or modification of critical data within Oracle Unified Directory or unauthorized access to all data accessible by the directory. This compromises confidentiality and integrity of the data but does not affect availability. The attack requires network access and low privileges but is difficult to exploit due to high attack complexity.

Oracle has released a Critical Security Patch Update in August 2026 that addresses this vulnerability. Customers are strongly advised to apply the available patches promptly to mitigate the risk. Staying on actively supported versions and applying Oracle security patches without delay is recommended. No additional mitigations are specified beyond applying the official patch.