What is the CVSS score of CVE-2026-60394?

CVE-2026-60394 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.3%.

Oracle GoldenGate CVE-2026-60394

EUVD-2026-46796 MEDIUM

Information Exposure (CWE-200)

2026-07-21 secalert_us@oracle.com

GHSA-5r44-q38j-rqh9

Oracle Information Disclosure Goldengate

5.3

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

vuln.today AI

5.3 MEDIUM

Authentication bypass over HTTPS with no credentials required justifies PR:N and AV:N; only partial data read with no write or disruption means C:L, I:N, A:N.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 09:19 vuln.today

DescriptionCVE.org

Vulnerability in Oracle GoldenGate (component: Admin Server Executable). Supported versions that are affected are 21.3-21.21 and 23.4-23.26.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle GoldenGate. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle GoldenGate accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).

AnalysisAI

Remote unauthenticated information disclosure in Oracle GoldenGate's Admin Server Executable allows network-accessible attackers to read a subset of GoldenGate-accessible data over HTTPS without any credentials. Affected versions span two active branches: 21.3-21.21 and 23.4-23.26.1. No public exploit or CISA KEV listing has been identified at time of analysis; Oracle classifies this as easily exploitable with a CVSS 5.3 Medium score reflecting limited confidentiality impact and no integrity or availability consequence.

Technical ContextAI

Oracle GoldenGate is an enterprise-grade heterogeneous data replication and streaming platform widely used for database migration, zero-downtime upgrades, and real-time data integration across Oracle and non-Oracle systems. The vulnerable component is the Admin Server Executable, which exposes an HTTPS administrative interface for managing GoldenGate deployments. The 'Authentication Bypass' tag in the intelligence data indicates that the Admin Server fails to enforce authentication on one or more endpoints or operations that should be restricted, consistent with CWE-306 (Missing Authentication for Critical Function) or CWE-287 (Improper Authentication) - though no formal CWE is assigned in the NVD record. The attack surface is the Admin Server's HTTPS listener, reachable over the network from any host with connectivity to the service port.

RemediationAI

Apply the Oracle Critical Patch Update for July 2026, documented at https://www.oracle.com/security-alerts/cpujul2026.html, which addresses this vulnerability for both affected version branches. Exact patched version numbers are not independently confirmed from the available data - consult the CPU advisory directly for target upgrade versions in the 21.x and 23.x streams. As an immediate compensating control, restrict network access to the GoldenGate Admin Server HTTPS port at the host firewall or network perimeter so that only authorized administrative hosts can reach the service; this eliminates the remote unauthenticated exposure without requiring a service restart. Note that network-layer restriction does not fix the underlying authentication bypass and must be treated as a temporary measure until the patch is applied.