CVE-2026-60359 Oracle Corporation CVE debrief

Who should care

Organizations using Oracle Unified Directory versions 12.2.1.4.0 and 14.1.2.1.0 should prioritize patching this vulnerability. Additionally, security teams and administrators responsible for Oracle Fusion Middleware and Unified Directory should be aware of the potential impacts and take necessary precautions.

Technical summary

The CVE-2026-60359 vulnerability is in the Oracle Unified Directory product of Oracle Fusion Middleware (component: OUD Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. The vulnerability allows unauthenticated attackers with network access via HTTP to compromise Oracle Unified Directory. While the vulnerability is in Oracle Unified Directory, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Unified Directory accessible data. The CVSS 3.1 Base Score is 8.6 (Confidentiality impacts). The CVSS Vector is (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N).

Defensive priority

High priority due to high CVSS score of 8.6 and potential for unauthorized access to critical data.

Recommended defensive actions

• Apply vendor patches or updates to Oracle Unified Directory versions 12.2.1.4.0 and 14.1.2.1.0.
• Implement network access controls to restrict HTTP access to Oracle Unified Directory.
• Monitor Oracle Unified Directory systems for potential attacks.
• Review and update incident response plans to address potential impacts on additional products.
• Conduct a thorough review of current system configurations and inventory of Oracle Unified Directory deployments.
• Establish a change management process to ensure timely application of security patches.
• Verify that compensating controls are in place for exposed systems while remediation is scheduled and verified.

Evidence notes

The CVE-2026-60359 vulnerability affects Oracle Unified Directory versions 12.2.1.4.0 and 14.1.2.1.0. It allows unauthenticated attackers with network access via HTTP to compromise Oracle Unified Directory, potentially impacting additional products. Successful attacks can result in unauthorized access to critical data. The CVSS 3.1 Base Score is 8.6, indicating high severity.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.