What is the CVSS score of CVE-2026-47022?

CVE-2026-47022 has a CVSS 3.1 base score of 3.3 (Low). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L. EPSS exploitation probability: 0.1%.

GoldenGate Stream Analytics CVE-2026-47022

EUVD-2026-46510 LOW

Uncontrolled Resource Consumption (CWE-400)

2026-07-21 oracle

GHSA-j465-g235-7vw4

Denial Of Service Oracle Goldengate Stream Analytics Oracle Corporation

3.3

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

3.3 LOW

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

vuln.today AI

3.3 LOW

Local attack vector with low-privilege requirement confirmed by description; only partial availability impact, no confidentiality or integrity effect.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 02:41 vuln.today

DescriptionCVE.org

Vulnerability in the GoldenGate Stream Analytics product of Oracle GoldenGate (component: Security). The supported version that is affected is 26.1.0.0.0. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where GoldenGate Stream Analytics executes to compromise GoldenGate Stream Analytics. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of GoldenGate Stream Analytics. CVSS 3.1 Base Score 3.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L).

AnalysisAI

Local partial denial-of-service in Oracle GoldenGate Stream Analytics 26.1.0.0.0 allows a low-privileged attacker with logon access to the host infrastructure to degrade availability of the analytics service. The vulnerability resides in the Security component and requires no user interaction once local access is established. No public exploit code has been identified at time of analysis, and the low CVSS score of 3.3 reflects a limited, non-critical impact confined to availability.

Technical ContextAI

GoldenGate Stream Analytics is an Oracle product built for real-time data stream processing and analytics, typically deployed in enterprise data integration pipelines. The affected CPE (cpe:2.3:a:oracle_corporation:goldengate_stream_analytics:*:*:*:*:*:*:*:*) identifies the Oracle Corporation's implementation at version 26.1.0.0.0. The vulnerability is located in the Security component of the product. No CWE is assigned, leaving the root cause class unspecified - this is a notable gap, as it prevents classification into known weakness categories such as improper resource handling or permission enforcement. The CVSS vector AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L indicates a straightforward local exploitation path with minimal complexity requirements, confined to the vulnerable system's availability with no scope change.

RemediationAI

Organizations should consult the Oracle July 2026 Critical Patch Update at https://www.oracle.com/security-alerts/cpujul2026.html for the specific patched version and apply Oracle's provided patch. The exact patched release version is not independently confirmed from the available intelligence - organizations should verify the remediated version directly with Oracle's advisory. As a compensating control, restrict logon access to the host infrastructure running GoldenGate Stream Analytics to only operationally necessary accounts, reducing the pool of users who could trigger the availability issue. Enforcing least-privilege access policies on the underlying OS accounts provides an effective mitigating layer. Because the vulnerability requires local logon, network-level controls alone are insufficient - host-level access controls are the most relevant defense.