CVE-2026-60422: Oracle Unified Directory Auth Bypass Flaw

CVE-2026-60422 Overview

CVE-2026-60422 is a critical vulnerability in Oracle Unified Directory (OUD), a component of Oracle Fusion Middleware. The flaw resides in the OUD Core component of version 14.1.2.1.0 and is exploitable over the network via the Lightweight Directory Access Protocol (LDAP). A low-privileged attacker can compromise the directory service and pivot to affect additional products due to a scope change. Successful exploitation allows unauthorized creation, deletion, or modification of directory data, full read access to accessible data, and partial denial of service against OUD.

Critical Impact
A low-privileged attacker with LDAP network access can read, modify, or delete all OUD-accessible data and cause partial denial of service, with impact extending beyond OUD due to scope change.

Affected Products

Oracle Unified Directory 14.1.2.1.0
Oracle Fusion Middleware (OUD Core component)
Downstream applications relying on OUD for identity data (impact extended by scope change)

Discovery Timeline

2026-07-21 - CVE-2026-60422 published to the National Vulnerability Database
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-60422

Vulnerability Analysis

The vulnerability affects the OUD Core component of Oracle Unified Directory 14.1.2.1.0. Oracle classifies the flaw as easily exploitable over LDAP by an authenticated attacker holding only low privileges. The scope change indicates that a successful attack crosses a security boundary, extending impact from OUD into other integrated products such as identity consumers, single sign-on systems, and provisioning workflows that trust directory data.

Successful exploitation yields full read access to data stored in or accessible through the directory, along with the ability to create, modify, or delete entries. Attackers can also trigger a partial denial of service against the OUD instance. Because directory servers frequently hold user accounts, group memberships, and authorization attributes, tampering with entries can enable privilege escalation across dependent applications.

The EPSS score is 0.297% (percentile 21.828) as of 2026-07-23. No public exploit code, CISA KEV listing, or in-the-wild exploitation has been reported at the time of publication.

Root Cause

Oracle has not published a detailed root cause analysis. Based on the attack vector and required privilege level, the flaw is reachable through standard LDAP operations exposed by the OUD Core service. Consult the Oracle Security Alert July 2026 for the authoritative advisory.

Attack Vector

The attacker requires network reachability to the OUD LDAP listener and valid credentials with low privileges. No user interaction is needed. Once authenticated, the attacker issues crafted LDAP operations that abuse the flaw in the OUD Core component to read or manipulate directory data outside their authorized scope and to affect additional trusting products.

No verified exploit code is available. See the Oracle Security Alert July 2026 for technical guidance from the vendor.

Detection Methods for CVE-2026-60422

Indicators of Compromise

Unexpected LDAP bind activity from low-privilege service accounts followed by search or modify operations against sensitive branches such as ou=People or ou=Groups.
Directory entries created, deleted, or modified outside change-management windows.
Sudden spikes in LDAP operation volume or partial unavailability of the OUD listener.
Authentication anomalies in downstream applications that consume OUD identity data.

Detection Strategies

Enable OUD access, audit, and change logs and forward them to a centralized log platform for correlation with authentication events.
Baseline normal LDAP query patterns per account and alert on deviations in search base, filter complexity, or attribute selection.
Correlate directory modifications with change tickets and flag out-of-band add, modify, or delete operations on privileged groups.

Monitoring Recommendations

Monitor OUD server health metrics for partial denial-of-service symptoms such as elevated response latency or thread exhaustion.
Track privileged group membership and administrative account attributes for unauthorized changes.
Alert on repeated failed binds followed by successful low-privilege binds from the same source.

How to Mitigate CVE-2026-60422

Immediate Actions Required

Apply the fixes from the Oracle Critical Patch Update referenced in the Oracle Security Alert July 2026 to all OUD 14.1.2.1.0 deployments.
Restrict network access to the OUD LDAP and LDAPS listeners to trusted application tiers using firewall rules or network policies.
Rotate credentials for low-privilege accounts that can bind to OUD and audit their permissions.
Review OUD audit logs for anomalous modify or delete operations dating back to before the patch date.

Patch Information

Oracle addressed CVE-2026-60422 in the July 2026 Critical Patch Update. Administrators must apply the fixes listed in the Oracle Security Alert July 2026 to Oracle Unified Directory 14.1.2.1.0. No supported workaround replaces patching.

Workarounds

Limit LDAP connectivity to OUD to trusted subnets and application hosts until patches are deployed.
Reduce the privileges of application bind accounts to the minimum required attributes and subtrees.
Enforce LDAPS with mutual TLS to constrain which clients can reach the affected service.

bash

# Configuration example: restrict OUD LDAP access at the host firewall
# Allow only trusted application subnet to reach LDAP (389) and LDAPS (636)
iptables -A INPUT -p tcp -s 10.20.30.0/24 --dport 389 -j ACCEPT
iptables -A INPUT -p tcp -s 10.20.30.0/24 --dport 636 -j ACCEPT
iptables -A INPUT -p tcp --dport 389 -j DROP
iptables -A INPUT -p tcp --dport 636 -j DROP