CVE-2026-60428
HighCVSS 8.2Exploitation Probability (EPSS)
Low risk16th percentile - higher than 16% of all known CVEs
Summary
Vulnerability in Oracle Unified Directory (part of Oracle Fusion Middleware) versions 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable, allows an unauthenticated attacker via LDAP to gain unauthorized access to critical data and modify it.
Risk Assessment
Risk of leakage or modification of directory data, potentially compromising identity and access management.
Recommendation
Apply the Oracle patch for versions 12.2.1.4.0 and 14.1.2.1.0. Restrict LDAP access to trusted networks only.
Other vulnerabilities in Oracle Fusion Middleware
See all- CVE-2026-60388Critical
Vulnerability in Oracle Fusion Middleware Service Delivery Platform (component: Messaging Enabler). Unauthenticated attacker via network (T3, IIOP) can take over the platform.
- CVE-2026-60387Critical
Vulnerability in Oracle Fusion Middleware Service Delivery Platform (component: Messaging Enabler). Unauthenticated attacker via network (T3, IIOP) can take over the platform.
- CVE-2026-60380Critical
Vulnerability in Oracle Fusion Middleware Service Delivery Platform (component: Messaging Enabler). Unauthenticated attacker via network (HTTP) can take over the platform.
- CVE-2026-60374Critical
Vulnerability in Oracle Fusion Middleware Service Delivery Platform (component: Messaging Enabler). Unauthenticated attacker via network (T3, IIOP) can take over the platform.
- CVE-2026-61099High
Vulnerability in Oracle WebCenter Enterprise Capture product (Oracle Fusion Middleware) in Client Bundle component. Affects versions 12.2.1.4.0 and 14.1.2.0.0. A low-privileged attacker with network access via HTTP can take over the system.
- CVE-2026-61098High
Vulnerability in Oracle WebCenter Enterprise Capture product (Oracle Fusion Middleware) in Client Bundle component. Affects versions 12.2.1.4.0 and 14.1.2.0.0. A low-privileged attacker with network access via HTTP can take over the system.
- CVE-2026-60657High
Vulnerability in Oracle WebCenter Content (part of Oracle Fusion Middleware) versions 12.2.1.4.0 and 14.1.2.0.0. Difficult to exploit, requires low privileges and user interaction, but may affect other products. Allows unauthorized access and modification of critical data.
- CVE-2026-60654High
Vulnerability in Oracle WebCenter Content (part of Oracle Fusion Middleware) versions 12.2.1.4.0 and 14.1.2.0.0. A low-privileged attacker with network access via HTTP can take over the system.
- CVE-2026-60563High
Vulnerability in Oracle WebCenter Portal (part of Oracle Fusion Middleware) versions 12.2.1.4.0 and 14.1.2.0.0. A low-privileged attacker with network access via HTTP can take over the portal.
- CVE-2026-60553High
Vulnerability in Oracle WebCenter Sites (part of Oracle Fusion Middleware) versions 12.2.1.4.0 and 14.1.2.0.0. Difficult to exploit, allows an unauthenticated attacker via HTTP to gain unauthorized access and modification of critical data, with possible impact on other products.
Original NVD description (English source)
Vulnerability in the Oracle Unified Directory product of Oracle Fusion Middleware (component: OUD Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via LDAP to compromise Oracle Unified Directory. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Unified Directory accessible data as well as unauthorized update, insert or delete access to some of Oracle Unified Directory accessible data. CVSS 3.1 Base Score 8.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N).