CVE-2026-60430: Oracle Unified Directory Auth Bypass Flaw

CVE-2026-60430 Overview

CVE-2026-60430 is a high-severity vulnerability in the Oracle Unified Directory (OUD) product within Oracle Fusion Middleware, specifically in the OUD Core component. The flaw allows a low-privileged attacker with network access via Lightweight Directory Access Protocol (LDAP) to compromise the directory service. Successful exploitation results in full takeover of Oracle Unified Directory, affecting confidentiality, integrity, and availability. Oracle disclosed the issue in its July 2026 Critical Patch Update. Affected supported versions are 12.2.1.4.0 and 14.1.2.1.0.

Critical Impact
A low-privileged remote attacker can take over Oracle Unified Directory over LDAP, gaining full control of the identity directory service.

Affected Products

Oracle Unified Directory 12.2.1.4.0
Oracle Unified Directory 14.1.2.1.0
Oracle Fusion Middleware (OUD Core component)

Discovery Timeline

2026-07-21 - CVE-2026-60430 published to the National Vulnerability Database (NVD)
2026-07-21 - Last updated in the NVD database
July 2026 - Addressed in the Oracle Critical Patch Update Advisory - July 2026

Technical Details for CVE-2026-60430

Vulnerability Analysis

Oracle Unified Directory is an LDAP-based directory service used to store and manage identity data. CVE-2026-60430 resides in the OUD Core component, which handles the core directory server operations exposed over LDAP.

The vulnerability is exploitable over the network and requires low attack complexity. An authenticated attacker holding only low-privileged credentials can trigger the flaw without user interaction. Exploitation impacts all three security properties, granting the attacker the ability to read, modify, and disrupt directory data.

Because OUD frequently serves as the identity backbone for Oracle Fusion Middleware deployments, takeover of the directory can cascade into broader enterprise compromise. Attackers gaining control can manipulate user records, group memberships, and authentication data used by downstream applications.

Root Cause

Oracle has not published the underlying technical root cause. The advisory attributes the flaw to the OUD Core component and confirms it is reachable through the LDAP protocol interface. No Common Weakness Enumeration (CWE) identifier has been assigned in the NVD entry.

Attack Vector

The attack vector is network-based over LDAP. An attacker authenticates to the OUD instance with a low-privileged bind and issues crafted LDAP operations against the core directory service. No user interaction is required, and the exploit does not cross a security scope boundary. Successful operations yield administrative control over the directory.

No public proof-of-concept exploit code is available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2026-60430

Indicators of Compromise

Unexpected LDAP bind operations from low-privileged accounts followed by administrative directory changes.
Sudden modifications to privileged group memberships, ACIs, or password policies inside OUD.
Anomalous LDAP traffic volumes or operations targeting core schema and configuration entries.
New or modified service accounts appearing in OUD without corresponding change tickets.

Detection Strategies

Enable OUD access, audit, and error logs, and forward them to a centralized SIEM for correlation.
Alert on LDAP MODIFY, ADD, and DELETE operations against cn=config, cn=admin data, or privileged organizational units.
Baseline normal LDAP client behavior and flag deviations in bind source IPs, operation types, and query rates.
Correlate authentication anomalies in downstream applications with directory changes in OUD.

Monitoring Recommendations

Monitor network segments hosting OUD listeners (default LDAP 389/LDAPS 636) for unusual client connections.
Track privileged account usage and enforce alerting on any elevation of low-privileged accounts.
Review OUD replication logs for unauthorized changes propagating between instances.

How to Mitigate CVE-2026-60430

Immediate Actions Required

Apply the July 2026 Oracle Critical Patch Update to all Oracle Unified Directory 12.2.1.4.0 and 14.1.2.1.0 deployments.
Inventory all OUD instances, including non-production and disaster recovery nodes, to ensure complete patch coverage.
Rotate credentials for any low-privileged accounts that could be used to reach the LDAP interface.
Restrict LDAP and LDAPS network exposure to trusted administrative and application subnets only.

Patch Information

Oracle addressed CVE-2026-60430 in the Oracle Critical Patch Update Advisory - July 2026. Administrators must apply the corresponding OUD patches for supported versions 12.2.1.4.0 and 14.1.2.1.0 following Oracle's documented upgrade procedures.

Workarounds

Enforce network-layer access controls that limit LDAP access to known application servers and administrators.
Require strong authentication and disable anonymous or weak bind mechanisms on OUD listeners.
Apply least-privilege ACIs so that no low-privileged account can invoke operations beyond its role.
Enable TLS for all LDAP traffic to prevent credential capture on the network path.

bash

# Configuration example: restrict OUD LDAP listener exposure and enforce TLS
# Replace placeholders with values appropriate to your environment.

# 1. Disable cleartext LDAP listener, keep only LDAPS
dsconfig set-connection-handler-prop \
  --handler-name "LDAP Connection Handler" \
  --set enabled:false

dsconfig set-connection-handler-prop \
  --handler-name "LDAPS Connection Handler" \
  --set enabled:true \
  --set listen-address:<internal-mgmt-ip>

# 2. Reject anonymous binds
dsconfig set-global-configuration-prop \
  --set reject-unauthenticated-requests:true

# 3. Verify configuration
dsconfig get-global-configuration-prop