CVE-2026-60425 Overview
CVE-2026-60425 is a denial-of-service vulnerability in the Oracle Unified Directory (OUD) product of Oracle Fusion Middleware. The flaw resides in the OUD Core component and affects supported versions 12.2.1.4.0 and 14.1.2.1.0. An unauthenticated attacker with network access via Lightweight Directory Access Protocol (LDAP) can trigger the condition. Successful exploitation causes a hang or repeatable crash, resulting in complete denial of service for the directory service.
Critical Impact
Unauthenticated remote attackers can crash or hang Oracle Unified Directory over LDAP, disrupting authentication and directory-dependent applications across the enterprise.
Affected Products
- Oracle Unified Directory 12.2.1.4.0
- Oracle Unified Directory 14.1.2.1.0
- Oracle Fusion Middleware deployments using OUD Core
Discovery Timeline
- 2026-07-21 - Oracle publishes advisory as part of the July 2026 Critical Patch Update
- 2026-07-21 - CVE-2026-60425 published to NVD
- 2026-07-21 - Last updated in NVD database
Technical Details for CVE-2026-60425
Vulnerability Analysis
The vulnerability resides in the OUD Core component of Oracle Unified Directory, Oracle's LDAP-based identity store. According to Oracle's advisory, the flaw is easily exploitable and requires no authentication or user interaction. Because OUD listens on the network for LDAP requests, any host able to reach the LDAP or LDAPS listener can send the malicious request.
Successful exploitation impacts availability only. Confidentiality and integrity of directory data remain intact, but the OUD process hangs or crashes and can be repeatedly triggered. Where OUD backs authentication for downstream systems, an outage cascades into single sign-on failures, application login errors, and disrupted provisioning workflows.
Root Cause
Oracle has not published the underlying defect class. Based on the advisory's description of a hang or repeatable crash triggered by unauthenticated LDAP traffic, the root cause is consistent with improper handling of malformed or resource-intensive LDAP protocol data units in the OUD Core request-processing path.
Attack Vector
The attack path requires network reachability to the OUD LDAP listener (default TCP 389) or LDAPS listener (default TCP 636). An attacker crafts an LDAP request that OUD Core fails to process safely, causing the server thread or process to hang or terminate. Because no bind credentials are required, exposure of the LDAP port to untrusted networks materially increases risk.
No public proof-of-concept exploit is currently available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Technical specifics are described in the Oracle July 2026 Critical Patch Update.
Detection Methods for CVE-2026-60425
Indicators of Compromise
- Unexpected termination or repeated restarts of the OUD server process
- OUD access logs showing malformed LDAP operations from a single source followed by a service hang
- Sudden spikes in TCP connections to ports 389 or 636 followed by connection resets
- Downstream authentication failures across applications that depend on OUD
Detection Strategies
- Monitor the OUD server.out, errors, and access logs for abnormal LDAP operation results and unhandled exceptions.
- Alert on OUD process restarts or unavailability of the LDAP listener via health checks.
- Inspect LDAP traffic for unusual message structures or oversized elements from unauthenticated sources.
- Correlate directory outages with source IPs generating repeated pre-bind LDAP requests.
Monitoring Recommendations
- Enable verbose LDAP audit logging on OUD and forward events to a centralized SIEM for correlation.
- Track service-level metrics such as response latency, active connections, and thread pool saturation on OUD instances.
- Baseline normal LDAP query volume per source and alert on deviations from unauthenticated peers.
How to Mitigate CVE-2026-60425
Immediate Actions Required
- Apply the July 2026 Oracle Critical Patch Update to all Oracle Unified Directory 12.2.1.4.0 and 14.1.2.1.0 instances.
- Restrict network access to OUD LDAP and LDAPS listeners to trusted management and application subnets only.
- Inventory all OUD deployments, including those embedded in Fusion Middleware stacks, to confirm patch coverage.
Patch Information
Oracle addressed CVE-2026-60425 in the July 2026 Critical Patch Update. Refer to the Oracle July 2026 Security Alerts for patch identifiers, download locations, and prerequisite bundle patches for each supported version.
Workarounds
- Place OUD behind a network firewall or LDAP-aware proxy that filters malformed requests when patching cannot be performed immediately.
- Deploy the OUD service in a highly available topology with multiple replicas behind a load balancer to absorb single-node crashes while remediation is scheduled.
- Rate-limit unauthenticated LDAP connections at the network layer to reduce the ability of a single source to trigger repeated crashes.
# Example: restrict LDAP/LDAPS access to trusted subnets using iptables
iptables -A INPUT -p tcp -m multiport --dports 389,636 -s 10.10.0.0/16 -j ACCEPT
iptables -A INPUT -p tcp -m multiport --dports 389,636 -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
