CVE-2026-60359 Overview
CVE-2026-60359 is a high-severity vulnerability in the Oracle Unified Directory (OUD) product of Oracle Fusion Middleware, within the OUD Core component. Affected supported versions are 12.2.1.4.0 and 14.1.2.1.0. An unauthenticated attacker with network access via HTTP can exploit this issue with low complexity. Successful exploitation can result in unauthorized access to critical data or complete access to all Oracle Unified Directory data. The vulnerability also introduces a scope change, meaning exploitation can significantly impact additional products beyond OUD itself.
Critical Impact
Remote unauthenticated attackers can obtain full read access to sensitive directory data over HTTP, with impact extending beyond Oracle Unified Directory due to the scope change.
Affected Products
- Oracle Fusion Middleware — Oracle Unified Directory 12.2.1.4.0
- Oracle Fusion Middleware — Oracle Unified Directory 14.1.2.1.0
- Component: OUD Core
Discovery Timeline
- 2026-07-21 - CVE-2026-60359 published to NVD
- 2026-07-21 - Last updated in NVD database
- July 2026 - Addressed in the Oracle Security Alert - July 2026
Technical Details for CVE-2026-60359
Vulnerability Analysis
The flaw resides in the OUD Core component of Oracle Unified Directory, Oracle's LDAP-based directory service used for identity data storage and authentication. The issue is reachable over HTTP without authentication, and Oracle classifies it as easily exploitable. Successful exploitation compromises the confidentiality of directory data while leaving integrity and availability unaffected. Because the vulnerability produces a scope change, attackers can pivot the impact to systems and products that trust or consume OUD data, broadening the blast radius beyond the directory service.
Root Cause
Oracle has not published detailed root cause information beyond the advisory. The confidentiality-only impact profile and network-based, unauthenticated exploitation path indicate an information disclosure weakness in HTTP-facing OUD Core functionality. See the Oracle Security Alert - July 2026 for vendor-supplied technical details.
Attack Vector
An attacker with network reachability to the HTTP interface of an affected OUD instance can trigger the vulnerability without credentials or user interaction. Because directory services frequently store account attributes, group memberships, and organizational metadata, exfiltrated data can support downstream account takeover, targeted phishing, and lateral movement across systems relying on OUD as an identity source. The EPSS score is 0.398% (percentile 32.342) as of 2026-07-23, indicating no observed in-the-wild exploitation at this time.
No verified public proof-of-concept code has been published. Refer to the Oracle advisory for exploitation prerequisites and mitigation guidance.
Detection Methods for CVE-2026-60359
Indicators of Compromise
- Unexpected HTTP requests to OUD administrative or REST endpoints originating from untrusted networks.
- Anomalous outbound data volumes from OUD servers, indicating potential bulk retrieval of directory data.
- Access log entries showing large or repeated unauthenticated queries against OUD Core HTTP interfaces.
Detection Strategies
- Enable verbose HTTP access logging on OUD and forward events to a centralized SIEM for correlation.
- Baseline normal query patterns against OUD Core and alert on statistical deviations in request rate, size, or source.
- Correlate OUD access events with network firewall and proxy logs to identify unauthorized reachability paths.
Monitoring Recommendations
- Monitor HTTP listeners on OUD instances for requests from IP ranges outside approved administrative segments.
- Track authentication failures alongside successful anonymous or unauthenticated reads on directory endpoints.
- Alert on configuration changes to OUD access controls, ACIs, or HTTP connection handlers.
How to Mitigate CVE-2026-60359
Immediate Actions Required
- Apply the patches published in the Oracle Critical Patch Update / Security Alert for July 2026 to all affected OUD 12.2.1.4.0 and 14.1.2.1.0 deployments.
- Inventory all Oracle Unified Directory instances and confirm exposure of HTTP interfaces to untrusted networks.
- Restrict network access to OUD HTTP endpoints to trusted administrative subnets using firewall or segmentation controls.
- Rotate credentials and secrets that may have been exposed through directory attributes if compromise is suspected.
Patch Information
Oracle has released fixes as part of the Oracle Security Alert - July 2026. Administrators should follow the CPU advisory to identify the specific patch set update applicable to their OUD version and apply it during the next available maintenance window.
Workarounds
- Disable or block the HTTP connection handler on OUD when it is not required, relying on LDAP/LDAPS for client access.
- Enforce strict network ACLs limiting HTTP reachability to OUD to a small set of management hosts.
- Place a reverse proxy or web application firewall in front of OUD HTTP endpoints to filter unauthenticated requests until patching is complete.
# Example: restrict OUD HTTP listener exposure at the host firewall (Linux/iptables)
# Allow only trusted admin subnet 10.10.20.0/24 to reach OUD HTTP port 1080
iptables -A INPUT -p tcp --dport 1080 -s 10.10.20.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 1080 -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
