CVE-2026-60969 affects Oracle Unified Directory versions 12.2.1.4.0 and 14.1.2.1.0. It is an easily exploitable vulnerability that allows a low privileged attacker with network access via LDAP to compromise the product. Successful exploitation can result in unauthorized access to critical or all data accessible through Oracle Unified Directory. The vulnerability has a CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N, reflecting network attack vector, low attack complexity, low privileges required, no user interaction, scope change, and high confidentiality impact. Oracle's August 2026 Critical Security Patch Update includes fixes for this vulnerability. No known exploits in the wild have been reported. The vendor strongly recommends applying patches without delay to mitigate risk.

Successful exploitation of this vulnerability can lead to unauthorized access to critical data or complete access to all data accessible via Oracle Unified Directory. The confidentiality of sensitive information is at high risk. The vulnerability does not impact integrity or availability but has a scope change that may affect additional Oracle products relying on Oracle Unified Directory.

Oracle has released fixes for this vulnerability as part of the August 2026 Critical Security Patch Update. Customers should apply the relevant patches for Oracle Unified Directory versions 12.2.1.4.0 and 14.1.2.1.0 promptly. Oracle strongly recommends remaining on actively supported versions and applying security patches without delay to prevent exploitation. No additional mitigation steps are indicated beyond patching.