PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-60359 Oracle Corporation CVE debrief

The CVE-2026-60359 vulnerability is in Oracle Unified Directory, a component of Oracle Fusion Middleware. This vulnerability, categorized under OUD Core, affects versions 12.2.1.4.0 and 14.1.2.1.0. It is an easily exploitable vulnerability that allows unauthenticated attackers with network access via HTTP to compromise Oracle Unified Directory. The potential impact is significant as attacks may affect additional products, leading to unauthorized access to critical data or complete access to all Oracle Unified Directory accessible data. The CVSS 3.1 Base Score is 8.6, indicating high severity, with confidentiality impacts. The CVSS Vector is (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N). Organizations should be aware of the potential impacts and take necessary precautions to mitigate this vulnerability.

Vendor
Oracle Corporation
Product
Oracle Unified Directory
CVSS
HIGH 8.6
CISA KEV
Not listed in stored evidence
Original CVE published
2026-07-21
Original CVE updated
2026-07-28
Advisory published
2026-07-21
Advisory updated
2026-07-28

Who should care

Organizations using Oracle Unified Directory versions 12.2.1.4.0 and 14.1.2.1.0 should prioritize patching this vulnerability. Additionally, security teams and administrators responsible for Oracle Fusion Middleware and Unified Directory should be aware of the potential impacts and take necessary precautions.

Technical summary

The CVE-2026-60359 vulnerability is in the Oracle Unified Directory product of Oracle Fusion Middleware (component: OUD Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. The vulnerability allows unauthenticated attackers with network access via HTTP to compromise Oracle Unified Directory. While the vulnerability is in Oracle Unified Directory, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Unified Directory accessible data. The CVSS 3.1 Base Score is 8.6 (Confidentiality impacts). The CVSS Vector is (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N).

Defensive priority

High priority due to high CVSS score of 8.6 and potential for unauthorized access to critical data.

Recommended defensive actions

  • Apply vendor patches or updates to Oracle Unified Directory versions 12.2.1.4.0 and 14.1.2.1.0.
  • Implement network access controls to restrict HTTP access to Oracle Unified Directory.
  • Monitor Oracle Unified Directory systems for potential attacks.
  • Review and update incident response plans to address potential impacts on additional products.
  • Conduct a thorough review of current system configurations and inventory of Oracle Unified Directory deployments.
  • Establish a change management process to ensure timely application of security patches.
  • Verify that compensating controls are in place for exposed systems while remediation is scheduled and verified.

Evidence notes

The CVE-2026-60359 vulnerability affects Oracle Unified Directory versions 12.2.1.4.0 and 14.1.2.1.0. It allows unauthenticated attackers with network access via HTTP to compromise Oracle Unified Directory, potentially impacting additional products. Successful attacks can result in unauthorized access to critical data. The CVSS 3.1 Base Score is 8.6, indicating high severity.

Official resources

AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-07-21T22:17:39.177Z and has not been modified since then.