CVE-2026-46776: High severity Oracle Oracle Unified Directory vulnerability
Vulnerability in the Oracle Unified Directory product of Oracle Fusion Middleware (component: OUD Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via LDAP to compromise Oracle Unified Directory. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Unified Directory accessible data as well as unauthorized read access to a subset of Oracle Unified Directory accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Unified Directory. CVSS 3.1 Base Score 8.6 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
oracle/unified-directoryfrom your environment.If Oracle Unified Directory is not required, uninstall/remove the product from affected systems to eliminate exposure.
- Configuration
Disable anonymous / unauthenticated LDAP binds or require strong authentication for LDAP operations if anonymous binds are not required.
Oracle Unified Directory (LDAP listener) anonymous_ldap_bind = disabled - Compensating control
Restrict network access to the Oracle Unified Directory LDAP service. Use firewall rules, ACLs, WAF or network segmentation to allow LDAP connectivity only from trusted management/peer IPs and block LDAP access from untrusted networks.
- Operational
Audit LDAP and application logs for indicators of unauthorized creation, deletion, modification, or read access. Isolate affected systems, restore impacted data from known-good backups where needed, and remediate any unauthorized changes before returning services to production.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-46776?
The severity of CVE-2026-46776 is rated high with a score of 8.6.
How do I fix CVE-2026-46776?
To fix CVE-2026-46776, upgrade to versions of Oracle Unified Directory that are not affected, such as those beyond 14.1.2.1.0.
Who is affected by CVE-2026-46776?
Organizations using affected versions of Oracle Unified Directory, specifically 12.2.1.4.0 and 14.1.2.1.0, are vulnerable to CVE-2026-46776.
What type of access does an attacker need to exploit CVE-2026-46776?
An attacker only needs unauthenticated network access via LDAP to exploit CVE-2026-46776.
What components of Oracle products are impacted by CVE-2026-46776?
CVE-2026-46776 affects the OUD Core component of the Oracle Unified Directory product in Oracle Fusion Middleware.