CVE-2026-60428: Oracle Unified Directory Auth Bypass Flaw

CVE-2026-60428 Overview

CVE-2026-60428 is a high-severity vulnerability in the Oracle Unified Directory (OUD) product of Oracle Fusion Middleware, specifically within the OUD Core component. The flaw affects supported versions 12.2.1.4.0 and 14.1.2.1.0. An unauthenticated attacker with network access via Lightweight Directory Access Protocol (LDAP) can exploit this vulnerability to compromise Oracle Unified Directory. Successful exploitation grants unauthorized read access to all OUD-accessible data and unauthorized update, insert, or delete access to a subset of that data. The vulnerability is easily exploitable and requires no user interaction.

Critical Impact
Unauthenticated network attackers can obtain complete read access to directory data and partial write access, exposing identity, credential, and configuration information stored in OUD.

Affected Products

Oracle Fusion Middleware — Oracle Unified Directory 12.2.1.4.0
Oracle Fusion Middleware — Oracle Unified Directory 14.1.2.1.0
Component: OUD Core

Discovery Timeline

2026-07-21 - CVE-2026-60428 published to NVD
2026-07-23 - Last updated in NVD database
Referenced in the Oracle Security Alert - July 2026

Technical Details for CVE-2026-60428

Vulnerability Analysis

The vulnerability resides in the OUD Core component of Oracle Unified Directory, Oracle's LDAP-based directory service used for storing identity and access data. The flaw is reachable over the network via LDAP without authentication and without user interaction. Attack complexity is low, meaning exploitation does not depend on race conditions, specific configurations, or attacker-controlled preconditions.

Exploitation yields high impact to confidentiality and low impact to integrity. Attackers can read the full directory tree, including user records, group memberships, and any credentials or attributes stored within OUD. They can also modify a subset of directory entries, enabling tampering with identity data that downstream applications rely on for authorization.

Because OUD frequently serves as an identity backbone for Oracle Fusion Middleware, WebLogic, and integrated enterprise applications, compromise of the directory can cascade into broader identity and access management failures across dependent services.

Root Cause

Oracle has not disclosed the specific technical root cause in the public advisory. The exposure is triggered through the LDAP protocol handler in the OUD Core component, indicating an authentication or authorization flaw in how OUD processes unauthenticated LDAP requests. Refer to the Oracle Security Alert - July 2026 for vendor-supplied details.

Attack Vector

The attack vector is network-based over LDAP (typically TCP port 389) or LDAPS (TCP port 636). An attacker sends crafted LDAP operations to an exposed OUD instance. Because no privileges or user interaction are required, any host with network reachability to the directory service can attempt exploitation. Internet-exposed OUD deployments and flat internal networks without LDAP segmentation are at highest risk.

No public proof-of-concept code has been released, and this CVE is not listed in the CISA Known Exploited Vulnerabilities catalog at the time of publication.

Detection Methods for CVE-2026-60428

Indicators of Compromise

Anomalous unauthenticated LDAP bind or search operations from unexpected source IPs against OUD listeners on ports 389 or 636.
Large-volume LDAP search requests returning full subtrees, indicating directory enumeration or extraction.
Unexpected modify, add, or delete LDAP operations executed without a corresponding authenticated administrative session.
OUD access logs showing successful operations correlated with anonymous or unbound sessions.

Detection Strategies

Enable verbose OUD access and audit logging, then baseline normal query patterns to surface anonymous bulk reads or writes.
Monitor LDAP traffic at the network layer for search filters with broad scopes (sub) targeting sensitive base DNs such as user or credential branches.
Correlate LDAP protocol telemetry with identity provider events to detect directory modifications that do not map to legitimate administrative workflows.

Monitoring Recommendations

Forward OUD logs and network flow data to a centralized SIEM or data lake for retention and correlation across identity, endpoint, and network sources.
Alert on any LDAP write operations originating from non-administrative subnets or service accounts.
Track external exposure of TCP ports 389 and 636 and alert on new inbound connections from untrusted networks.

How to Mitigate CVE-2026-60428

Immediate Actions Required

Apply the fixes distributed in the Oracle Critical Patch Update referenced in the Oracle Security Alert - July 2026 to all affected OUD 12.2.1.4.0 and 14.1.2.1.0 instances.
Inventory all Oracle Unified Directory deployments and confirm patch status through Oracle's OPatch tooling.
Restrict network reachability to OUD LDAP and LDAPS ports to trusted application tiers and administrative jump hosts only.
Review OUD access and audit logs for signs of anonymous enumeration or unauthorized modifications since the patch release date.

Patch Information

Oracle addressed CVE-2026-60428 in the July 2026 Critical Patch Update. Administrators must apply the OUD-specific patches for the affected releases as documented in the Oracle Critical Patch Update advisory. Oracle only supports fixes applied to currently supported versions, so unsupported deployments should be upgraded before patching.

Workarounds

If immediate patching is not feasible, place OUD listeners behind network access control lists that permit only authorized client subnets.
Disable anonymous LDAP binds where operationally supported and require authenticated connections for all search and modify operations.
Enforce TLS on LDAPS and reject cleartext LDAP where possible to reduce passive exposure while validating patch deployment.

bash

# Example: restrict OUD LDAP/LDAPS access at the host firewall (Linux/firewalld)
firewall-cmd --permanent --zone=oud --add-source=10.20.30.0/24
firewall-cmd --permanent --zone=oud --add-port=389/tcp
firewall-cmd --permanent --zone=oud --add-port=636/tcp
firewall-cmd --permanent --zone=public --remove-port=389/tcp
firewall-cmd --permanent --zone=public --remove-port=636/tcp
firewall-cmd --reload