What is the CVSS score of CVE-2026-60397?

CVE-2026-60397 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L. EPSS exploitation probability: 0.2%.

Oracle GoldenGate CVE-2026-60397

EUVD-2026-46799 MEDIUM

Improper Resource Shutdown or Release (CWE-404)

2026-07-21 secalert_us@oracle.com

GHSA-c7pw-qv7h-fxmj

Oracle Denial Of Service Goldengate

4.3

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

4.3 MEDIUM

AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

vuln.today AI

4.3 MEDIUM

Adjacent vector confirmed by description; PR:N per unauthenticated access; only partial availability impact with no confidentiality or integrity effect.

3.1 AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

4.0 AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 09:19 vuln.today

DescriptionCVE.org

Vulnerability in Oracle GoldenGate (component: Admin Server Executable). Supported versions that are affected are 19.1.0.0.0-19.30.0.0, 21.3-21.21 and 23.4-23.26.1. Easily exploitable vulnerability allows unauthenticated attacker with access to the physical communication segment attached to the hardware where the Oracle GoldenGate executes to compromise Oracle GoldenGate. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle GoldenGate. CVSS 3.1 Base Score 4.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).

AnalysisAI

Partial denial of service in Oracle GoldenGate's Admin Server Executable component is reachable by unauthenticated attackers with access to the adjacent physical communication segment. Three major release trains are affected - 19.1.0.0.0 through 19.30.0.0, 21.3 through 21.21, and 23.4 through 23.26.1 - making this broadly relevant across GoldenGate deployments. No public exploit code and no CISA KEV listing have been identified at time of analysis; exploitation is bounded by the adjacent-network requirement.

Technical ContextAI

Oracle GoldenGate is an enterprise real-time data replication and integration platform, widely used to move and transform data between heterogeneous databases and systems. The affected component is the Admin Server Executable, which handles administrative communications for the GoldenGate instance. The CVSS vector specifies AV:A (Adjacent Network), meaning the attack surface is limited to attackers on the same LAN, VLAN, or broadcast domain as the GoldenGate host - not reachable from arbitrary internet-facing positions. No CWE classification was supplied, so the precise root cause class (e.g., input validation failure, resource exhaustion, parsing flaw) cannot be confirmed from available data. The impact is scoped to partial availability degradation (A:L) with no confidentiality or integrity exposure, consistent with an unauthenticated condition that causes a service disruption rather than a full crash or data exposure.

RemediationAI

Apply Oracle's Critical Patch Update for July 2026, available at https://www.oracle.com/security-alerts/cpujul2026.html. The provided intelligence does not specify exact patched build numbers - consult Oracle's CPU patch matrix to identify the correct patch for your specific release train (19c, 21c, or 23ai). As a compensating control prior to patching, isolate the GoldenGate Admin Server Executable's listening port to a dedicated management VLAN or segment accessible only from authorized administrative hosts, effectively constraining the AV:A attack surface to trusted personnel only. Implement network ACLs or host-based firewall rules blocking the Admin Server port from untrusted adjacent network segments. The trade-off of these network controls is the operational overhead of additional VLAN configuration and ACL maintenance, but they are effective given that exploitation is entirely bounded by the adjacent-network vector.