CVE-2026-46776: Oracle Unified Directory Auth Bypass Flaw

CVE-2026-46776 Overview

CVE-2026-46776 is a high-severity vulnerability in the Oracle Unified Directory (OUD) component of Oracle Fusion Middleware. The flaw resides in the OUD Core component and affects supported versions 12.2.1.4.0 and 14.1.2.1.0. An unauthenticated attacker with network access via Lightweight Directory Access Protocol (LDAP) can compromise Oracle Unified Directory. Successful exploitation enables unauthorized creation, deletion, or modification of critical data, read access to a subset of accessible data, and a partial denial of service. The weakness maps to [CWE-284: Improper Access Control].

Critical Impact
Unauthenticated network attackers can modify or delete directory data and cause partial denial of service against Oracle Unified Directory deployments.

Affected Products

Oracle Unified Directory 12.2.1.4.0
Oracle Unified Directory 14.1.2.1.0
Oracle Fusion Middleware (OUD Core component)

Discovery Timeline

2026-06-17 - CVE-2026-46776 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database
June 2026 - Addressed in the Oracle Security Alert: June 2026

Technical Details for CVE-2026-46776

Vulnerability Analysis

The vulnerability exists in the OUD Core component of Oracle Unified Directory, Oracle's LDAP-based directory service for identity and access management. The flaw is classified under [CWE-284: Improper Access Control], indicating that the affected component does not properly restrict actions performed over the LDAP protocol.

An attacker reaches the vulnerable code path by sending crafted LDAP requests to a network-accessible Oracle Unified Directory instance. No authentication, user interaction, or elevated privileges are required. The impact profile is skewed toward integrity, with high integrity impact, low confidentiality impact, and low availability impact reported by Oracle. EPSS data places the exploitation probability at 0.363% (28.027 percentile) as of 2026-06-18.

Root Cause

The root cause is improper enforcement of access control inside the OUD Core component. Authorization checks fail to constrain operations that should be restricted to authenticated and privileged principals. As a result, LDAP operations from anonymous clients can reach functionality that performs writes and reads against directory data.

Attack Vector

Exploitation is remote and network-based. The attacker requires only LDAP reachability to the target server, typically TCP port 389 or 636. Because the attack complexity is low and no credentials are required, any exposed Oracle Unified Directory instance is reachable for opportunistic exploitation. Successful attacks can create, modify, or delete entries used for authentication, authorization, group membership, and application configuration, producing downstream effects across identity-dependent systems.

No public proof-of-concept code has been published. Refer to the Oracle Security Alert: June 2026 for vendor-supplied technical details.

Detection Methods for CVE-2026-46776

Indicators of Compromise

Unexpected add, modify, or delete LDAP operations originating from anonymous binds or unfamiliar source addresses.
Modifications to privileged directory entries, group memberships, or access control instructions (ACIs) that do not correlate with change tickets.
Spikes in LDAP error responses or partial service degradation in OUD audit logs.
Connections to OUD listeners on ports 389, 636, or custom LDAP ports from outside expected administrative networks.

Detection Strategies

Enable and centralize OUD access and audit logs, then alert on anonymous write operations and changes to sensitive containers such as cn=admins or cn=config.
Baseline normal LDAP client populations and flag new source IPs performing modify or delete operations.
Correlate directory changes with downstream authentication anomalies in dependent applications to surface tampering.

Monitoring Recommendations

Forward OUD logs into a centralized analytics platform for retention and correlation with network telemetry.
Monitor north-south and east-west network flows to OUD listener ports and alert on unexpected exposure.
Track configuration drift on OUD servers, including ACI and password policy changes, against an approved configuration baseline.

How to Mitigate CVE-2026-46776

Immediate Actions Required

Apply the Oracle Critical Patch Update referenced in the Oracle Security Alert: June 2026 to all affected Oracle Unified Directory instances.
Inventory all OUD deployments running 12.2.1.4.0 and 14.1.2.1.0 and prioritize internet-exposed or partner-facing servers.
Restrict network access to LDAP and LDAPS listeners so only known application and administrative hosts can connect.
Review recent directory changes and authentication events for evidence of tampering prior to patching.

Patch Information

Oracle addressed CVE-2026-46776 in its June 2026 Critical Patch Update cycle. The patch is distributed through My Oracle Support for Oracle Fusion Middleware customers. Customers should follow Oracle's patching guidance for OUD 12.2.1.4.0 and 14.1.2.1.0, validate patches in a staging environment, and confirm that the OUD Core component version reflects the post-patch build after deployment.

Workarounds

Place OUD behind network segmentation and firewall rules that permit LDAP traffic only from authorized clients.
Disable anonymous bind where business requirements allow, and enforce strong authentication for all LDAP operations.
Tighten ACIs on sensitive entries so that write operations require named, privileged identities.
Enable verbose audit logging on OUD until patching is complete to support rapid incident response.

bash

# Configuration example: restrict LDAP exposure with host-based firewall rules
# Allow only application and admin subnets to reach OUD on 389/636
iptables -A INPUT -p tcp -s 10.20.0.0/16 --dport 389 -j ACCEPT
iptables -A INPUT -p tcp -s 10.20.0.0/16 --dport 636 -j ACCEPT
iptables -A INPUT -p tcp --dport 389 -j DROP
iptables -A INPUT -p tcp --dport 636 -j DROP

# Disable anonymous bind in OUD (run from OUD instance)
dsconfig set-global-configuration-prop \
  --set reject-unauthenticated-requests:true \
  --hostname oud.example.com --port 4444 \
  --bindDN "cn=Directory Manager" --bindPasswordFile pwd.txt \
  --trustAll --no-prompt