CVE-2026-46773: Critical severity Oracle Oracle Unified Directory vulnerability
Vulnerability in the Oracle Unified Directory product of Oracle Fusion Middleware (component: OUD Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via LDAP to compromise Oracle Unified Directory. Successful attacks of this vulnerability can result in takeover of Oracle Unified Directory. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
If LDAP is not required or until a vendor fix is applied, disable the LDAP listener or reconfigure it to bind only to localhost or a management-only network interface to prevent external unauthenticated access.
Oracle Unified Directory (OUD) LDAP listener = disabled / bind to management-only interface - Compensating control
Restrict network access to Oracle Unified Directory's LDAP service: block or limit inbound LDAP (TCP 389 and 636) from untrusted networks using firewalls/ACLs; allow only trusted management networks or IPs.
- Compensating control
Isolate affected OUD instances from general network access (segment into a restricted network zone or place behind a VPN/WAF) until a vendor patch or mitigation is available.
- Operational
Assume possible compromise where the vulnerability may have been exploited: perform incident response actions such as reviewing OUD logs for suspicious activity, verifying integrity of the service, rotating any credentials and keys that the directory issues or stores, and restoring from known-good backups if compromise is confirmed.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-46773?
CVE-2026-46773 has a critical severity rating of 9.8.
How do I fix CVE-2026-46773?
To address CVE-2026-46773, you should upgrade to the patched versions of Oracle Unified Directory.
Who is affected by CVE-2026-46773?
CVE-2026-46773 affects users of Oracle Unified Directory versions 12.2.1.4.0 and 14.1.2.1.0.
What impact does CVE-2026-46773 have?
CVE-2026-46773 allows an unauthenticated attacker with network access via LDAP to compromise the Oracle Unified Directory.
When was CVE-2026-46773 published?
CVE-2026-46773 was published on June 16, 2026.