CVE-2026-46773: Vulnerability in the Oracle Unified Directory product of Oracle Fusion Middleware (component: OUD Core)

Synopsis

An unauthenticated remote code execution vulnerability affects Oracle Unified Directory (OUD Core) versions 12.2.1.4.0 and 14.1.2.1.0. The flaw is reachable over the network via LDAP without any credentials or user interaction, making it trivially exploitable from any host that can reach the LDAP listener. Successful exploitation results in full takeover of the Oracle Unified Directory instance, giving the attacker complete control over confidentiality, integrity, and availability. No fix version has been published yet; HarborGuard tracks this advisory and will surface a patched-image rebuild the moment Oracle releases one.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the OUD LDAP listener over the network; any host with network access to the exposed port can attempt exploitation.

• AuthenticationNot required

  No credentials of any kind are needed; the vulnerability is exploitable by a completely unauthenticated attacker.

• Victim interactionNot required

  The attack is fully passive from the victim's perspective and requires no action from any user or administrator.

• Attack complexityDetail

  Exploitation is described as easy and condition-free, with no race conditions or environment-specific factors required to trigger the vulnerability.

Blast Radius

• A successful attacker reads all data held in the directory, including credentials, group memberships, and any attributes stored in the LDAP tree.
• The attacker can write or delete directory entries, modifying access-control records, user accounts, and organizational data.
• The attacker can crash or hang the OUD service, denying authentication and directory lookups to all dependent applications.
• Because OUD Core is typically a central identity store, a takeover can cascade into unauthorized access across every application and service that trusts the directory for authentication or authorization.