CVE-2026-46776: Oracle Unified Directory Unauthenticated LDAP Access Vulnerability

Technical summary

This vulnerability in Oracle Unified Directory's core LDAP functionality stems from improper access controls (CWE-284). The flaw permits unauthenticated network-based attackers to bypass authentication requirements via LDAP protocol communication. Successful exploitation grants attackers the ability to perform create, read, update, and delete operations on directory objects without valid credentials. The vulnerability carries a CVSS 3.1 base score of 8.6, reflecting high integrity impact (data modification and deletion), partial confidentiality loss, and limited availability impact. Attack complexity is low, and no user interaction is required; the only prerequisite is network reachability to the LDAP service port.

Business impact

Compromise of an Oracle Unified Directory instance can expose and alter critical enterprise directory data, including user identities, organizational hierarchies, authentication credentials, and application configuration references. In environments where Unified Directory serves as a central identity repository, unauthorized modification poses a cascading risk to dependent systems and applications relying on accurate directory information. Loss of data integrity may undermine access control decisions across the enterprise. Additionally, partial service disruption could affect authentication and authorization operations, impacting business continuity for user login and access provisioning workflows.

Affected systems

Oracle Unified Directory versions 12.2.1.4.0 and 14.1.2.1.0 are confirmed vulnerable. These versions are part of Oracle Fusion Middleware deployments, commonly used in enterprise identity and access management stacks. Organizations running either of these specific patch levels should treat this as a priority for inventory and assessment. Verify your deployed version against Oracle's official versioning documentation to confirm exposure.

Exploitability

This vulnerability is easily exploitable from a technical standpoint. No authentication is required, attack complexity is minimal, and the attacker needs only network access to the LDAP port. The vulnerability does not require user interaction or special configuration to trigger. However, practical exploitation depends on the attacker's ability to reach the Unified Directory instance over the network—firewalling, network segmentation, and LDAP access controls can reduce attack surface. Organizations without network-level protection of their directory services face heightened risk.

Remediation

Apply the security patch released by Oracle for versions 12.2.1.4.0 and 14.1.2.1.0. Consult Oracle's June 2026 critical patch update (CPU) advisory for the specific patched versions and download locations. In parallel, restrict network access to LDAP ports (typically 389 and 636) using firewall rules, network access control lists, and VPN requirements. Ensure the Unified Directory service runs with minimal necessary privileges and monitor LDAP connection logs for suspicious unauthenticated access attempts.

Patch guidance

Oracle has released patches addressing this vulnerability as part of their June 2026 critical patch cycle. Affected organizations should retrieve patched versions for 12.2.1.4.0 and 14.1.2.1.0 from Oracle's official patch portal and apply them following standard change management procedures. Test patches in a non-production environment before production deployment. Verify patch installation by confirming the updated version number and reviewing the patch descriptor documentation. If your environment cannot immediately patch, prioritize compensating controls such as network isolation and access restrictions.

Detection guidance

Monitor LDAP query logs for unexpected unauthenticated access attempts, unusual bind operations, or queries attempting to read or modify sensitive directory objects without valid credentials. Network intrusion detection systems should flag LDAP protocol activity from unexpected sources. Configuration management tools can help track unauthorized changes to directory entries. Log aggregation platforms can correlate failed and successful LDAP operations to identify reconnaissance or exploitation patterns. Organizations without detailed LDAP logging should enable it immediately on affected instances.

Why prioritize this

This vulnerability warrants high-priority remediation due to its easy exploitability, lack of authentication requirements, and direct impact on data integrity and confidentiality. Oracle Unified Directory typically underpins enterprise identity infrastructure; compromise can cascade across dependent systems. The CVSS 8.6 score reflects substantial risk. Although not yet in CISA's Known Exploited Vulnerabilities catalog, the technical ease of exploitation and critical nature of affected systems justify expedited patching schedules.

Risk score, explained

The CVSS 3.1 score of 8.6 (HIGH severity) reflects the combination of unauthenticated network accessibility (AV:N, PR:N), low attack complexity (AC:L), high integrity impact (I:H—data can be modified or deleted), partial confidentiality impact (C:L—some data can be read), and limited availability impact (A:L—partial service disruption possible). No user interaction is required (UI:N). The high integrity impact is the dominant risk factor, as unauthorized modification of directory data undermines trust in identity infrastructure.

Frequently asked questions