CVE-2026-46774: Critical severity Oracle Oracle Unified Directory vulnerability
Vulnerability in the Oracle Unified Directory product of Oracle Fusion Middleware (component: OUD Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via RMI to compromise Oracle Unified Directory. Successful attacks of this vulnerability can result in takeover of Oracle Unified Directory. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
If RMI is not required, disable the RMI listener in the OUD configuration. If RMI is required, restrict the listener to localhost or a dedicated management network so it is not reachable from untrusted networks.
Oracle Unified Directory (OUD) - RMI RMI network listener = disabled or restricted to management network/localhost - Compensating control
Block or restrict network access to OUD RMI interfaces at network perimeter and internal firewalls/ACLs. Allow access only from trusted management IPs or place OUD instances in an isolated network segment (management VLAN) to prevent unauthenticated network access via RMI.
- Operational
Assume potential compromise if OUD instances were reachable via RMI. Perform incident response actions such as investigating logs and integrity of OUD, rotating credentials and certificates used by OUD and connected systems, and restoring from known-good backups as needed.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-46774?
CVE-2026-46774 has a critical severity rating of 9.8.
How do I fix CVE-2026-46774?
To fix CVE-2026-46774, update Oracle Unified Directory to the latest version that is not affected.
What products are affected by CVE-2026-46774?
CVE-2026-46774 affects Oracle Unified Directory versions 12.2.1.4.0 and 14.1.2.1.0.
Can CVE-2026-46774 be exploited remotely?
Yes, CVE-2026-46774 can be easily exploited by an unauthenticated attacker with network access via RMI.
What types of impacts can result from CVE-2026-46774?
CVE-2026-46774 can allow an attacker to compromise confidentiality, integrity, and availability of the Oracle Unified Directory.