CVE-2026-60895: Oracle Unified Directory Auth Bypass Flaw

CVE-2026-60895 Overview

CVE-2026-60895 affects the Oracle Unified Directory product within Oracle Fusion Middleware, specifically the OUD Core component. The flaw impacts supported versions 12.2.1.4.0 and 14.1.2.1.0. A low-privileged attacker with network access via Lightweight Directory Access Protocol (LDAP) can exploit this vulnerability to compromise directory data.

Successful exploitation allows unauthorized creation, deletion, or modification of critical data, along with read access to all directory-accessible information. Oracle disclosed the issue in its August 2026 Critical Patch Update advisory. The vulnerability is difficult to exploit but carries high confidentiality and integrity impact.

Critical Impact
Attackers with valid low-privilege LDAP credentials can gain read and write access to all data managed by Oracle Unified Directory, including identity and authentication records.

Affected Products

Oracle Unified Directory 12.2.1.4.0
Oracle Unified Directory 14.1.2.1.0
Oracle Fusion Middleware deployments using OUD Core

Discovery Timeline

2026-08-18 - CVE-2026-60895 published to NVD
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-60895

Vulnerability Analysis

Oracle Unified Directory (OUD) is an enterprise LDAP directory service used for identity storage, authentication, and access management. The vulnerability resides in the OUD Core component that processes LDAP operations. An authenticated attacker sending crafted LDAP requests can bypass authorization controls enforced by the directory server.

The attack requires network reachability to the LDAP listener and valid low-privilege credentials. Oracle classifies the attack complexity as high, indicating that specific preconditions or timing must be met to achieve reliable exploitation. Once exploited, the attacker gains full read and write access to entries the directory manages, including account records, group memberships, and access control policies.

Because OUD often stores authentication data for downstream Fusion Middleware components, compromise of the directory can cascade into broader identity infrastructure impact.

Root Cause

Oracle has not published implementation details for CVE-2026-60895. The advisory references OUD Core as the vulnerable component and NVD tracks the weakness as NVD-CWE-noinfo. The technical root cause remains undisclosed pending vendor detail release.

Attack Vector

The attack vector is network-based over LDAP or LDAPS. The attacker must authenticate with a low-privilege directory account before issuing the malicious operations. No user interaction is required, and the scope is unchanged, meaning the impact is confined to the directory service itself.

Exploitation code is not publicly available. Public exploit databases and CISA KEV do not list this CVE as of the last update.

// No verified proof-of-concept code is available for CVE-2026-60895.
// Refer to the Oracle Security Alert for authoritative technical guidance.

Detection Methods for CVE-2026-60895

Indicators of Compromise

Unexpected LDAP add, modify, or delete operations originating from low-privilege service accounts
Directory entries showing modification timestamps that do not correlate with authorized change windows
Bind activity from unusual source IP addresses targeting the OUD administrative or replication ports
Sudden growth or shrinkage in directory entry counts without a corresponding change request

Detection Strategies

Enable OUD access and audit logging, then baseline normal write operations per account and alert on deviations
Correlate LDAP bind events with the requesting principal's typical privilege scope to flag anomalous writes
Monitor for repeated failed operations that precede a successful privileged action, indicating exploitation attempts

Monitoring Recommendations

Forward OUD audit logs to a centralized analytics platform for retention and correlation with identity events
Track modifications to sensitive branches such as cn=admins, ou=groups, and password attributes in real time
Alert on LDAP traffic from network segments that should not communicate with the directory tier

How to Mitigate CVE-2026-60895

Immediate Actions Required

Apply Oracle's August 2026 Critical Patch Update to all Oracle Unified Directory 12.2.1.4.0 and 14.1.2.1.0 instances
Inventory OUD deployments and restrict LDAP network exposure to trusted management and application subnets
Rotate credentials for any low-privilege OUD accounts that could be leveraged as an initial foothold
Review directory change logs for unauthorized modifications made prior to patch deployment

Patch Information

Oracle addresses CVE-2026-60895 in the August 2026 Critical Patch Update. See the Oracle Security Alert for the applicable patch bundles and installation guidance for Oracle Fusion Middleware.

Workarounds

Enforce strict network access control lists in front of the LDAP listener until the patch is applied
Require multi-factor authentication for administrative access paths that interact with OUD
Reduce the privilege footprint of application service accounts binding to the directory

bash

# Example: restrict LDAP access at the host firewall to trusted subnets
iptables -A INPUT -p tcp --dport 1389 -s 10.10.20.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 1636 -s 10.10.20.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 1389 -j DROP
iptables -A INPUT -p tcp --dport 1636 -j DROP