CVE-2026-60436: Oracle Unified Directory DoS Vulnerability

CVE-2026-60436 Overview

CVE-2026-60436 is a denial of service vulnerability in the Oracle Unified Directory (OUD) product of Oracle Fusion Middleware. The flaw resides in the OUD Core component and affects supported versions 12.2.1.4.0 and 14.1.2.1.0. An unauthenticated attacker with network access via Lightweight Directory Access Protocol (LDAP) can trigger a hang or repeatable crash, resulting in a complete denial of service of Oracle Unified Directory. Oracle disclosed the issue in the July 2026 Critical Patch Update.

Critical Impact
A remote, unauthenticated attacker can crash or hang Oracle Unified Directory over LDAP, disrupting directory services and any downstream authentication or authorization that depends on them.

Affected Products

Oracle Unified Directory 12.2.1.4.0
Oracle Unified Directory 14.1.2.1.0
Oracle Fusion Middleware deployments that rely on the OUD Core component

Discovery Timeline

2026-07-21 - CVE-2026-60436 published to NVD
2026-07-21 - Last updated in NVD database
July 2026 - Oracle addresses the vulnerability in the Oracle Security Alert July 2026

Technical Details for CVE-2026-60436

Vulnerability Analysis

CVE-2026-60436 is a network-reachable denial of service issue affecting the Oracle Unified Directory Core. The attack is delivered over LDAP, the primary protocol OUD exposes to clients. No authentication, user interaction, or elevated privileges are required to trigger the condition. The impact is limited to availability. Confidentiality and integrity of directory data are not affected. Successful exploitation causes the directory server to hang or crash in a repeatable manner, producing a full outage of directory services. Because many enterprise applications, single sign-on flows, and access control decisions depend on OUD, an outage of the directory frequently cascades into authentication failures across dependent systems.

Root Cause

Oracle has not published detailed root cause information for CVE-2026-60436. Based on the vendor description, the flaw is reachable through the LDAP listener in the OUD Core component and can be triggered by a crafted LDAP interaction that the server does not handle safely. Full technical details are available in the Oracle Security Alert July 2026.

Attack Vector

The attack vector is network based. An adversary sends malicious LDAP traffic to an exposed OUD instance on its listener port, typically 389 for LDAP or 636 for LDAPS. Because the vulnerability is unauthenticated and low complexity, any attacker who can reach the LDAP port can trigger the crash. Repeated exploitation produces a sustained denial of service. Directory servers exposed to untrusted networks, or reachable from compromised internal hosts, are at highest risk.

No public proof of concept or exploit is currently known for CVE-2026-60436, and the EPSS score at publication indicates a low near-term likelihood of observed exploitation. See the vendor advisory for technical specifics.

Detection Methods for CVE-2026-60436

Indicators of Compromise

Unexpected OUD service crashes, restarts, or hangs recorded in logs/server.out or the OUD access and error logs
Bursts of malformed or anomalous LDAP requests from a single source targeting ports 389 or 636
Sudden increase in bind or search failures across applications that consume OUD for authentication

Detection Strategies

Monitor OUD process health and JVM status for repeated abnormal termination correlated with inbound LDAP traffic
Inspect LDAP access logs for high volumes of requests from unauthenticated clients preceding service degradation
Deploy network detection signatures on LDAP traffic to flag malformed BER-encoded messages or protocol anomalies at the perimeter

Monitoring Recommendations

Forward OUD server, access, and error logs to a centralized analytics platform and alert on crash or restart patterns
Track availability of the LDAP and LDAPS listeners with synthetic bind checks from monitoring nodes
Correlate directory outages with upstream authentication failures in dependent applications to identify exploitation quickly

How to Mitigate CVE-2026-60436

Immediate Actions Required

Apply the July 2026 Oracle Critical Patch Update to all Oracle Unified Directory 12.2.1.4.0 and 14.1.2.1.0 instances
Inventory every OUD deployment, including non-production and disaster recovery instances, and confirm patch status
Restrict network reachability of LDAP and LDAPS ports to trusted management and application subnets only

Patch Information

Oracle addressed CVE-2026-60436 in the July 2026 Critical Patch Update. Administrators should download and apply the patches referenced in the Oracle Security Alert July 2026 for the affected OUD versions. Follow Oracle Fusion Middleware patching procedures, including pre-patch backups and post-patch validation of directory replication and application bind operations.

Workarounds

Place OUD listeners behind network access controls that limit LDAP exposure to known client ranges until patching is complete
Enforce LDAP connection and request rate limits at load balancers or firewalls to reduce the blast radius of malformed traffic
Enable high availability replication so that a crash of one OUD instance does not remove directory services from production

bash

# Example: restrict LDAP and LDAPS access to trusted subnets on Linux hosts running OUD
iptables -A INPUT -p tcp -s 10.10.0.0/16 --dport 389 -j ACCEPT
iptables -A INPUT -p tcp -s 10.10.0.0/16 --dport 636 -j ACCEPT
iptables -A INPUT -p tcp --dport 389 -j DROP
iptables -A INPUT -p tcp --dport 636 -j DROP