What is the CVSS score of CVE-2026-60395?

CVE-2026-60395 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.3%.

Oracle GoldenGate CVE-2026-60395

EUVD-2026-46797 MEDIUM

Information Exposure (CWE-200)

2026-07-21 secalert_us@oracle.com

GHSA-8hpg-8fx4-246r

Oracle Information Disclosure Goldengate

4.3

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

vuln.today AI

4.3 MEDIUM

Admin Server is HTTP-network-accessible; low-privilege account nominally required; impact strictly limited to partial confidentiality read with no integrity or availability effect.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 09:19 vuln.today

DescriptionCVE.org

Vulnerability in Oracle GoldenGate (component: Admin Server Executable). Supported versions that are affected are 19.1.0.0.0-19.30.0.0, 21.3-21.21 and 23.4-23.26.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle GoldenGate. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle GoldenGate accessible data. CVSS 3.1 Base Score 4.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N).

AnalysisAI

Unauthorized read access to Oracle GoldenGate data is possible through a flaw in the Admin Server Executable component, affecting three major release trains spanning versions 19.1.0.0.0 through 23.26.1. A low-privileged network attacker can exploit this Authentication Bypass issue over HTTP without user interaction to read a subset of GoldenGate-accessible data. No public exploit code and no CISA KEV listing have been identified at time of analysis; risk is elevated primarily for deployments exposing the Admin Server to untrusted networks.

Technical ContextAI

Oracle GoldenGate is an enterprise real-time data replication and change-data-capture platform used to synchronize data across heterogeneous databases and cloud environments. The affected component - the Admin Server Executable - is the HTTP-accessible management interface responsible for administrative operations including configuration, monitoring, and process control. The ENISA EUVD and Oracle CPU advisory tag this as an Authentication Bypass vulnerability, pointing to a likely root cause of CWE-287 (Improper Authentication) or CWE-863 (Incorrect Authorization), though Oracle has not formally assigned a CWE identifier. The CVSS vector (AV:N/AC:L/PR:L/UI:N) confirms the Admin Server is reachable over the network via HTTP and that only a low-privileged account is nominally required. Affected version ranges per Oracle and ENISA are: 19.1.0.0.0-19.30.0.0, 21.3-21.21, and 23.4-23.26.1.

RemediationAI

Apply the patches detailed in the Oracle Critical Patch Update for July 2026, available at https://www.oracle.com/security-alerts/cpujul2026.html. Exact patched build numbers are not independently confirmed from the available data - consult the CPU advisory directly for the specific patch identifiers applicable to each GoldenGate release train (19.x, 21.x, 23.x). As an immediate compensating control, restrict network access to the Admin Server Executable's HTTP port to trusted administrative hosts only, using host-based firewall rules or network ACLs; this does not eliminate the vulnerability but eliminates remote exploitation from untrusted segments. Additionally, audit and minimize the number of low-privileged GoldenGate accounts with access to the Admin Server endpoint, reducing the pool of accounts that could be abused. Note that the Authentication Bypass tag suggests even this access restriction may be insufficient if the bypass allows unauthenticated access - treat patching as the definitive remediation.