CVE-2026-46773: Oracle Unified Directory Auth Bypass Flaw

CVE-2026-46773 Overview

CVE-2026-46773 is a critical vulnerability in the Oracle Unified Directory (OUD) product of Oracle Fusion Middleware, specifically in the OUD Core component. The flaw allows an unauthenticated attacker with network access via Lightweight Directory Access Protocol (LDAP) to compromise the directory service. Successful exploitation results in full takeover of Oracle Unified Directory, impacting confidentiality, integrity, and availability. Affected releases include Oracle Unified Directory versions 12.2.1.4.0 and 14.1.2.1.0. The weakness is categorized under improper access control [CWE-284].

Critical Impact
Unauthenticated network attackers can take over Oracle Unified Directory deployments over LDAP, exposing enterprise identity stores to compromise.

Affected Products

Oracle Unified Directory 12.2.1.4.0
Oracle Unified Directory 14.1.2.1.0
Oracle Fusion Middleware (OUD Core component)

Discovery Timeline

2026-06-17 - CVE-2026-46773 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database
2026-06-18 - EPSS score recorded at 0.483% (percentile 37.79)

Technical Details for CVE-2026-46773

Vulnerability Analysis

The vulnerability resides in the OUD Core component of Oracle Unified Directory, an LDAP-based directory service used for enterprise identity management. An attacker can reach the service over the network without authentication and without user interaction. Successful exploitation yields complete compromise of the directory, including the ability to read, modify, and disrupt directory data.

Because OUD typically stores user accounts, group memberships, and authorization data for downstream applications, takeover of the directory has cascading effects across federated systems that rely on it for authentication and policy decisions. Oracle classifies the issue as easily exploitable in its June 2026 Critical Patch Update advisory.

Root Cause

The issue is mapped to [CWE-284] Improper Access Control. The OUD Core component fails to correctly enforce access restrictions on LDAP-reachable functionality, allowing unauthenticated callers to perform privileged operations reserved for trusted administrators. Oracle has not published deeper technical specifics beyond the advisory at the time of disclosure.

Attack Vector

The attack vector is network-based over LDAP. An attacker who can reach the LDAP listener of an affected Oracle Unified Directory instance sends crafted requests that bypass access control checks. No credentials, prior foothold, or user interaction are required. Internet-exposed or insufficiently segmented OUD instances are at the highest risk.

No verified public proof-of-concept code is available. Refer to the Oracle Security Alert - June 2026 CPU for vendor-provided technical detail.

Detection Methods for CVE-2026-46773

Indicators of Compromise

Unexpected administrative LDAP operations (add, modify, delete on privileged entries) from unauthenticated or anonymous binds.
New or modified directory accounts, ACIs, or password policies that were not introduced through change management.
Anomalous spikes in LDAP traffic targeting OUD listeners from untrusted source addresses.

Detection Strategies

Audit OUD access logs for operations performed under the anonymous bind DN or without a corresponding authenticated session.
Correlate OUD logs with downstream application authentication events to identify privilege changes followed by suspicious logins.
Hunt for outbound connections or scheduled tasks originating from OUD hosts, which would be uncommon for a directory server.

Monitoring Recommendations

Forward OUD access and error logs to a centralized analytics platform and alert on changes to schema, ACIs, and privileged groups.
Monitor exposure of LDAP ports (389, 636, 1389, 1636) at network boundaries and flag any externally reachable instances.
Baseline normal LDAP query volume and alert on deviations indicative of enumeration or exploitation attempts.

How to Mitigate CVE-2026-46773

Immediate Actions Required

Apply the fixes from the Oracle Critical Patch Update of June 2026 to all Oracle Unified Directory 12.2.1.4.0 and 14.1.2.1.0 deployments.
Restrict network access to OUD LDAP and LDAPS listeners so only trusted application hosts and administrative workstations can connect.
Rotate credentials and review privileged directory entries after patching, on the assumption that pre-patch exposure may have allowed tampering.

Patch Information

Oracle addressed CVE-2026-46773 in the June 2026 Critical Patch Update. Administrators should consult the Oracle Security Alert - June 2026 CPU for the exact patch identifiers and installation procedures for each supported version.

Workarounds

Place OUD instances behind a firewall or LDAP-aware proxy that enforces source-IP allowlisting until patches are deployed.
Disable or block anonymous binds and unauthenticated LDAP operations at the listener configuration where business requirements allow.
Increase logging verbosity on OUD to capture all bind and modify operations during the remediation window for forensic readiness.

bash

# Example: restrict LDAP listener exposure with host-based firewall rules
# Allow only trusted application subnet to reach OUD LDAP/LDAPS ports
iptables -A INPUT -p tcp -s 10.10.20.0/24 --dport 1389 -j ACCEPT
iptables -A INPUT -p tcp -s 10.10.20.0/24 --dport 1636 -j ACCEPT
iptables -A INPUT -p tcp --dport 1389 -j DROP
iptables -A INPUT -p tcp --dport 1636 -j DROP