CVE-2026-46776: Vulnerability in the Oracle Unified Directory product of Oracle Fusion Middleware (component: OUD Core)

Synopsis

This is an unauthenticated network-exploitable vulnerability in the OUD Core component of Oracle Unified Directory, affecting versions 12.2.1.4.0 and 14.1.2.1.0. An attacker reachable over the network via LDAP requires no credentials and no victim interaction to exploit the flaw. Successful exploitation allows unauthorized read access to a subset of directory data, full creation, deletion, or modification of critical directory data, and a partial denial of service. No fix versions have been published yet; HarborGuard tracks this advisory and will make a patched-image rebuild available the moment upstream ships a fix.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the Oracle Unified Directory service over the network via LDAP; the service must be exposed to the attacker's network segment.

• AuthenticationNot required

  No credentials are needed; the vulnerability is exploitable by a completely unauthenticated attacker.

• Victim interactionNot required

  No user or administrator action is required to trigger the vulnerability; the attacker operates entirely on their own.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions or special environmental configuration.

Blast Radius

• Reads a subset of stored Oracle Unified Directory data, which may include user attributes, group memberships, or other LDAP entries.
• Creates, deletes, or modifies critical directory entries and all accessible directory data, enabling account manipulation or privilege escalation within systems that rely on the directory.
• Causes a partial disruption to the Oracle Unified Directory service, degrading authentication and directory-lookup availability for dependent applications.
• Any system that delegates authentication or authorization decisions to Oracle Unified Directory inherits the integrity impact of tampered directory data.