CVE-2026-60850: Oracle Unified Directory Auth Bypass Flaw

CVE-2026-60850 Overview

CVE-2026-60850 is a high-severity vulnerability in Oracle Unified Directory, a component of Oracle Fusion Middleware. The flaw resides in the OUD Core component and affects supported versions 12.2.1.4.0 and 14.1.2.1.0. An unauthenticated attacker with network access via Lightweight Directory Access Protocol (LDAP) can exploit the vulnerability to compromise Oracle Unified Directory. Successful exploitation can result in unauthorized access to critical data or complete access to all data managed by Oracle Unified Directory. Oracle disclosed the issue in the August 2026 Critical Patch Update.

Critical Impact
An unauthenticated remote attacker can retrieve sensitive directory data over LDAP without user interaction, exposing identity records stored in Oracle Unified Directory.

Affected Products

Oracle Unified Directory 12.2.1.4.0
Oracle Unified Directory 14.1.2.1.0
Oracle Fusion Middleware deployments using the OUD Core component

Discovery Timeline

2026-08-18 - CVE-2026-60850 published to the National Vulnerability Database
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-60850

Vulnerability Analysis

Oracle Unified Directory (OUD) is an LDAP directory service used for enterprise identity storage, authentication, and authorization. This vulnerability allows an unauthenticated attacker who can reach the LDAP service over the network to compromise the confidentiality of directory data. The attack requires no privileges and no user interaction. Oracle categorizes the impact strictly as confidentiality loss, with no direct integrity or availability effect. Because directory services typically hold user identities, group memberships, and access-control metadata, an information disclosure here can enable broader identity-based attacks against downstream applications relying on OUD.

Root Cause

Oracle has not published detailed technical root-cause information beyond identifying the OUD Core component as the affected module. NVD categorizes the weakness as NVD-CWE-noinfo, indicating the specific CWE has not been publicly assigned. The advisory states that the flaw is easily exploitable over LDAP by an unauthenticated attacker, consistent with a missing or improper access-control check inside the directory-processing pipeline. Refer to the Oracle Critical Patch Update Advisory - August 2026 for vendor guidance.

Attack Vector

The attack originates from the network and targets the LDAP listener exposed by Oracle Unified Directory. An attacker crafts LDAP requests directed at the OUD service to elicit responses containing directory data the attacker is not authorized to read. No authenticated bind is required, and no user interaction is needed. Environments that expose OUD LDAP or LDAPS endpoints to untrusted networks face the highest risk. Internal network exposure remains a concern where attackers with a foothold can pivot to identity infrastructure.

No public proof-of-concept has been released, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog at the time of publication.

Detection Methods for CVE-2026-60850

Indicators of Compromise

Anonymous or unauthenticated LDAP bind operations followed by broad search requests against OUD instances.
LDAP search operations returning larger-than-expected result sets to clients not previously observed in baseline traffic.
Connections to OUD LDAP ports (389, 636, 1389, 1636) from unexpected internal or external source addresses.

Detection Strategies

Enable OUD access logging and review search filters and scopes for suspicious wildcard queries against sensitive base DNs.
Correlate LDAP request volume and unique source addresses against historical baselines to identify enumeration attempts.
Alert on unauthenticated LDAP operations that request attributes such as userPassword, krbPrincipalKey, or other credential-adjacent fields.

Monitoring Recommendations

Forward OUD audit and access logs to a centralized analytics platform for long-term retention and correlation.
Monitor for outbound data volumes from OUD hosts that deviate from expected replication and query patterns.
Track authentication failures and rebinding sequences targeting service accounts that share the OUD infrastructure.

How to Mitigate CVE-2026-60850

Immediate Actions Required

Apply the fixes referenced in the Oracle Critical Patch Update Advisory - August 2026 to all OUD 12.2.1.4.0 and 14.1.2.1.0 deployments.
Inventory every Oracle Unified Directory instance, including test and disaster-recovery environments, to confirm patch coverage.
Restrict network reachability of OUD LDAP and LDAPS listeners to trusted management and application subnets only.

Patch Information

Oracle addressed CVE-2026-60850 as part of the August 2026 Critical Patch Update. Administrators should review the advisory and apply the patch matching the deployed OUD version (12.2.1.4.0 or 14.1.2.1.0). Follow Oracle's documented patching procedure, including pre-patch backups and post-patch verification of directory services and replication topology.

Workarounds

Limit LDAP exposure using host-based firewalls and network ACLs until the patch can be applied.
Enforce LDAPS with mutual TLS where feasible and disable anonymous bind on all OUD instances.
Review and tighten global access control instructions (ACIs) so that unauthenticated users cannot read sensitive attributes.

bash

# Example: restrict LDAP access at the network layer (iptables)
iptables -A INPUT -p tcp --dport 1389 -s 10.0.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 1636 -s 10.0.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 1389 -j DROP
iptables -A INPUT -p tcp --dport 1636 -j DROP

# Example: disable anonymous bind in Oracle Unified Directory
dsconfig set-global-configuration-prop \
  --set reject-unauthenticated-requests:true \
  --hostname oud.example.com --port 4444 \
  --bindDN "cn=Directory Manager" --bindPasswordFile pw.txt --no-prompt