CVE-2026-60914: Oracle Unified Directory Auth Bypass Flaw

CVE-2026-60914 Overview

CVE-2026-60914 is a high-severity information disclosure vulnerability in Oracle Unified Directory, a component of Oracle Fusion Middleware. The flaw resides in the OUD Core component and can be exploited by an unauthenticated attacker with network access over the Lightweight Directory Access Protocol (LDAP). Successful exploitation grants unauthorized access to critical data or full read access to all data managed by Oracle Unified Directory. Affected releases include Oracle Unified Directory 12.2.1.4.0 and 14.1.2.1.0. Oracle disclosed the issue in its August 2026 Critical Patch Update advisory.

Critical Impact
An unauthenticated remote attacker can retrieve confidential directory data over LDAP without user interaction, exposing account, group, and identity records.

Affected Products

Oracle Unified Directory 12.2.1.4.0
Oracle Unified Directory 14.1.2.1.0
Oracle Fusion Middleware deployments using the OUD Core component

Discovery Timeline

2026-08-18 - CVE-2026-60914 published to the National Vulnerability Database (NVD)
2026-08-20 - Last updated in NVD database
August 2026 - Oracle releases fix in the Oracle Security Alert

Technical Details for CVE-2026-60914

Vulnerability Analysis

Oracle Unified Directory (OUD) is an LDAP-compliant directory service used to store user, group, and application identity data across enterprise environments. The vulnerability allows an unauthenticated attacker to reach the OUD Core over the network and obtain access to directory-resident data that should require authentication and authorization.

The attack requires no privileges and no user interaction. Because LDAP directories typically hold identity attributes, credentials metadata, group membership, and application configuration, exposure of this data provides adversaries with material for follow-on attacks such as credential stuffing, targeted phishing, and privilege mapping. The impact is scoped to confidentiality; the flaw does not modify data or affect availability.

Root Cause

Oracle has not published a detailed root-cause analysis. The National Vulnerability Database records the weakness as NVD-CWE-noinfo. Based on the advisory text, the issue permits an LDAP client to reach data paths in OUD Core that should be gated by authentication or access-control instructions.

Attack Vector

An attacker sends crafted LDAP requests to an exposed Oracle Unified Directory instance. Because network access to the LDAP listener is the only prerequisite, any OUD deployment reachable from untrusted networks is directly exploitable. Internally reachable instances are exposed to lateral-movement scenarios where an attacker has gained a foothold in a segmented environment. Refer to the Oracle Security Alert for vendor-supplied technical details.

No public proof-of-concept exploit has been published, and CVE-2026-60914 is not listed in the CISA Known Exploited Vulnerabilities catalog. The current EPSS probability is 0.398%.

Detection Methods for CVE-2026-60914

Indicators of Compromise

Anonymous or unauthenticated LDAP bind requests followed by broad search operations against OUD instances
LDAP search queries with wide base DNs or objectClass=* filters originating from unexpected source addresses
Unusual volumes of LDAP SEARCH responses returning large result sets from OUD listeners on TCP 389 or 636

Detection Strategies

Enable OUD access logging and alert on unauthenticated binds that transition into search operations returning sensitive attributes
Correlate LDAP traffic against an allowlist of expected client subnets and service accounts
Inspect network flow data for LDAP sessions originating from workstations, internet-facing hosts, or other non-directory clients

Monitoring Recommendations

Forward OUD audit and access logs to a centralized analytics platform for retention and correlation
Baseline normal LDAP query patterns per application and flag statistical outliers in result-set size or query rate
Monitor for exposure of TCP 389 and 636 on perimeter interfaces using external attack-surface scanning

How to Mitigate CVE-2026-60914

Immediate Actions Required

Apply the August 2026 Oracle Critical Patch Update to Oracle Unified Directory 12.2.1.4.0 and 14.1.2.1.0 deployments
Inventory all OUD instances and confirm none are reachable from untrusted networks
Rotate credentials and secrets stored in directory attributes that may have been exposed prior to patching

Patch Information

Oracle addresses CVE-2026-60914 in the August 2026 Critical Patch Update. Refer to the Oracle Security Alert for the exact patch bundles, prerequisite versions, and post-installation validation steps.

Workarounds

Restrict LDAP listener access using network ACLs, host-based firewalls, or segmentation policies until patches are deployed
Require authenticated binds and enforce OUD access-control instructions (ACIs) that limit anonymous read access
Terminate LDAP traffic through TLS (ldaps:// on TCP 636) and disable clear-text LDAP where feasible
Review and tighten global ACIs so that sensitive attributes are not returned to unauthenticated or low-privilege sessions

bash

# Example: restrict OUD LDAP listener to trusted subnets using iptables
iptables -A INPUT -p tcp --dport 389 -s 10.10.20.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 636 -s 10.10.20.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 389 -j DROP
iptables -A INPUT -p tcp --dport 636 -j DROP