CVE-2026-60425 Oracle Corporation CVE debrief

Who should care

Organizations using Oracle Unified Directory versions 12.2.1.4.0 and 14.1.2.1.0 should prioritize remediation due to the high CVSS score of 7.5 and the potential for complete DOS of Oracle Unified Directory. Security teams, vulnerability management teams, and operators responsible for Oracle Unified Directory deployments should review the CVE and NVD records, assess their exposure, and apply remediation guidance from Oracle. Additionally, defenders should verify the integrity of their deployments and monitor for potential exploitation attempts.

Technical summary

CVE-2026-60425 is a vulnerability in Oracle Unified Directory, a product of Oracle Fusion Middleware. The vulnerability is located in the OUD Core component and allows unauthenticated attackers with network access via LDAP to compromise the directory. This can lead to a hang or frequently repeatable crash (complete DOS) of Oracle Unified Directory. The vulnerability has a CVSS score of 7.5, indicating high severity, and affects versions 12.2.1.4.0 and 14.1.2.1.0. Organizations should prioritize remediation by reviewing and applying vendor guidance, verifying affected versions, and implementing compensating controls.

Defensive priority

High priority due to high CVSS score of 7.5 and potential for complete DOS of Oracle Unified Directory.

Recommended defensive actions

• Inventory and verify Oracle Unified Directory versions 12.2.1.4.0 and 14.1.2.1.0 for potential vulnerability
• Implement compensating controls to monitor and restrict LDAP access to Oracle Unified Directory
• Review and apply vendor remediation guidance from Oracle
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.

Evidence notes

The CVE-2026-60425 vulnerability affects Oracle Unified Directory versions 12.2.1.4.0 and 14.1.2.1.0. Evidence is based on official CVE and NVD records, which indicate that unauthenticated attackers with network access via LDAP can compromise the directory, potentially causing a hang or frequently repeatable crash. The CVSS score of 7.5 and the potential for complete DOS of Oracle Unified Directory highlight the importance of remediation. Defensive measures include verifying Oracle Unified Directory versions, implementing compensating controls, and reviewing vendor remediation guidance.

Official resources