CVE-2026-46774: Oracle Unified Directory Auth Bypass Flaw

CVE-2026-46774 Overview

CVE-2026-46774 affects Oracle Unified Directory (OUD), a component of Oracle Fusion Middleware. The flaw resides in the OUD Core component and impacts versions 12.2.1.4.0 and 14.1.2.1.0. An unauthenticated attacker with network access via Remote Method Invocation (RMI) can compromise the directory service. Successful exploitation results in full takeover of Oracle Unified Directory, with high impact to confidentiality, integrity, and availability. The weakness is categorized under [CWE-284] Improper Access Control.

Critical Impact
Unauthenticated remote attackers can take over Oracle Unified Directory deployments via RMI, gaining full control over identity and directory data.

Affected Products

Oracle Unified Directory 12.2.1.4.0
Oracle Unified Directory 14.1.2.1.0
Oracle Fusion Middleware deployments embedding the affected OUD Core component

Discovery Timeline

2026-06-17 - CVE-2026-46774 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database
2026-06-18 - EPSS score recorded at 0.483%

Technical Details for CVE-2026-46774

Vulnerability Analysis

The vulnerability exists in the OUD Core component of Oracle Unified Directory. Oracle classifies it as easily exploitable, requiring no authentication, no user interaction, and only network reachability to the RMI service. Successful exploitation grants attackers full control of the directory server, which typically stores authentication data, user attributes, and group memberships for enterprise applications.

Because Oracle Unified Directory often serves as the authoritative LDAP store, compromise extends beyond the host itself. Attackers can manipulate identity records, escalate privileges across federated systems, and read or alter sensitive attributes used by downstream applications. The CWE-284 classification indicates the root issue is improper access control on a network-exposed interface.

Root Cause

The root cause is improper access control on the RMI interface exposed by Oracle Unified Directory. The service accepts requests from unauthenticated network clients and performs privileged operations without sufficient authorization checks. Oracle has not published source-level details, and no public proof-of-concept has been released at the time of writing.

Attack Vector

The attack vector is network-based and targets the RMI endpoint of Oracle Unified Directory. An attacker who can reach the RMI listener over the network sends crafted requests to invoke privileged operations. No credentials are required, and no user interaction is needed. Refer to the Oracle Security Alert for vendor-supplied technical context.

// No verified public proof-of-concept is available for CVE-2026-46774.
// See the Oracle Security Alert for vendor guidance and patch references.

Detection Methods for CVE-2026-46774

Indicators of Compromise

Unexpected RMI connections to Oracle Unified Directory listener ports from external or non-administrative network segments.
New or modified administrative entries, ACIs, or password policies in OUD that do not correspond to change-management records.
Unscheduled restarts of the OUD process or appearance of unfamiliar Java classes loaded into the OUD JVM.

Detection Strategies

Inspect OUD access and audit logs for anonymous or unauthenticated operations targeting administrative subtrees.
Monitor JVM and operating system process telemetry on OUD hosts for child processes spawned by the directory service, which is unusual under normal operation.
Correlate RMI traffic captured at network sensors with authentication events on connected applications to detect lateral movement following directory compromise.

Monitoring Recommendations

Restrict RMI port exposure with network ACLs and alert on any connection attempts from outside the administrative management network.
Enable verbose OUD audit logging and forward logs to a centralized analytics platform for retention and correlation.
Baseline directory schema and ACI configurations, then alert on deviations using configuration management tooling.

How to Mitigate CVE-2026-46774

Immediate Actions Required

Apply the patches published in the Oracle Critical Patch Update referenced in the Oracle Security Alert to all affected OUD instances.
Block RMI access to Oracle Unified Directory at the network perimeter and internal firewalls, allowing only trusted administrative hosts.
Audit OUD for unauthorized changes to administrative accounts, ACIs, and replication agreements before and after patching.

Patch Information

Oracle addressed CVE-2026-46774 in the June 2026 Critical Patch Update. Administrators running Oracle Unified Directory 12.2.1.4.0 or 14.1.2.1.0 should apply the corresponding patches as documented in the Oracle advisory. Verify patch deployment by checking the OUD build version after installation.

Workarounds

Disable or firewall the RMI listener if it is not required for operational use.
Place Oracle Unified Directory behind a management VLAN that is unreachable from user and internet-facing networks.
Enforce mutual TLS and IP allowlists on any administrative interfaces that must remain accessible until patching is complete.

bash

# Example: restrict RMI access to OUD using host-based firewall (Linux)
# Replace <RMI_PORT> with the configured Oracle Unified Directory RMI port
# and <ADMIN_CIDR> with the trusted administration subnet.

iptables -A INPUT -p tcp --dport <RMI_PORT> -s <ADMIN_CIDR> -j ACCEPT
iptables -A INPUT -p tcp --dport <RMI_PORT> -j DROP