What is the CVSS score of CVE-2026-60399?

CVE-2026-60399 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.3%.

Oracle GoldenGate CVE-2026-60399

EUVD-2026-46801 MEDIUM

Uncontrolled Resource Consumption (CWE-400)

2026-07-21 secalert_us@oracle.com

GHSA-j796-5j63-6g43

Oracle Denial Of Service Goldengate

6.5

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

6.5 MEDIUM

HTTP network access requires low-level authentication (PR:L); no complexity barrier; pure availability impact with no confidentiality or integrity effect.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 09:18 vuln.today

DescriptionCVE.org

Vulnerability in Oracle GoldenGate (component: Receiver Service Executable). Supported versions that are affected are 19.1.0.0.0-19.30.0.0, 21.3-21.21 and 23.4-23.26.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle GoldenGate. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle GoldenGate. CVSS 3.1 Base Score 6.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).

AnalysisAI

Denial-of-service conditions in Oracle GoldenGate's Receiver Service Executable allow a low-privileged attacker with HTTP network access to crash or indefinitely hang the replication service. Three major version lines are affected - 19.x, 21.x, and 23.x - covering a broad enterprise installed base. No public exploit code or active exploitation has been identified at time of analysis; risk is moderated by the low-privilege authentication requirement but elevated by low attack complexity and the business-critical role GoldenGate plays in continuous database replication pipelines.

Technical ContextAI

Oracle GoldenGate is an enterprise data replication and integration platform that enables real-time, log-based change data capture and delivery across heterogeneous database environments. The Receiver Service Executable is the target-side component responsible for accepting replicated change records from source Extract processes over HTTP. A vulnerability in this component's HTTP request handling allows a low-privileged user to trigger a complete hang or repeated crash of the Receiver Service, effectively halting replication. No CWE is assigned in the advisory, so the root cause class - whether resource exhaustion, null dereference, infinite loop, or similar - cannot be determined from available data. Affected CPE covers Oracle GoldenGate versions 19.1.0.0.0 through 19.30.0.0, 21.3 through 21.21, and 23.4 through 23.26.1.

RemediationAI

Apply the patches distributed in the Oracle Critical Patch Update for July 2026, available through the Oracle support portal and referenced at https://www.oracle.com/security-alerts/cpujul2026.html. Oracle CPU advisories bundle fixes per component; consult My Oracle Support for the exact patch ID applicable to each GoldenGate release line (19.x, 21.x, 23.x). If immediate patching is not feasible, restrict HTTP access to the GoldenGate Receiver Service port to only trusted Extract-side hosts using network ACLs or host-based firewall rules, reducing exposure to authenticated internal users who should not have direct HTTP connectivity to the Receiver. Additionally, enforce strict least-privilege controls on GoldenGate service accounts, limiting which accounts can reach the Receiver Service endpoint. Note that network restrictions do not eliminate the vulnerability but reduce the attacker pool; they may also interfere with legitimate replication traffic if not carefully scoped. No workaround that fully mitigates the flaw without patching is described in available references.