What is the CVSS score of CVE-2026-61079?

CVE-2026-61079 has a CVSS 3.1 base score of 5.8 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:L/A:H. EPSS exploitation probability: 0.1%.

Oracle GoldenGate CVE-2026-61079

EUVD-2026-47290 MEDIUM

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-v4jj-q5qf-cc8v

Oracle Authentication Bypass Goldengate

5.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

5.8 MEDIUM

AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:L/A:H

vuln.today AI

5.8 MEDIUM

Local-only vector confirmed by description; PR:H and AC:H required per description; UI:R from mandatory victim interaction; I:L since only partial data modification is possible.

3.1 AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:L/A:H

4.0 AV:L/AC:H/AT:P/PR:H/UI:A/VC:H/VI:L/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Local

Attack Complexity

High

Privileges Required

High

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

Low

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 08:26 vuln.today

DescriptionCVE.org

Vulnerability in Oracle GoldenGate (component: Libraries). Supported versions that are affected are 19.1.0.0.0-19.30.0.0, 21.3-21.21 and 23.4-23.26.2. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where Oracle GoldenGate executes to compromise Oracle GoldenGate. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle GoldenGate accessible data as well as unauthorized update, insert or delete access to some of Oracle GoldenGate accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle GoldenGate. CVSS 3.1 Base Score 5.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:L/A:H).

AnalysisAI

Oracle GoldenGate Libraries contain a local, high-complexity flaw affecting versions 19.1.0.0.0 through 19.30.0.0, 21.3 through 21.21, and 23.4 through 23.26.2 that allows a high-privileged local attacker - with an additional required victim interaction - to gain complete read access to all GoldenGate-accessible data, partially manipulate data integrity, and cause a complete denial of service via hang or repeatable crash. Tagged as an authentication bypass by intelligence sources, the vulnerability likely allows an already-privileged operator to circumvent an internal GoldenGate security control within the Libraries component, elevating their effective access beyond their authorized scope. No public exploit code or CISA KEV listing has been identified at time of analysis.

Technical ContextAI

Oracle GoldenGate is a real-time data replication and integration platform commonly deployed in large Oracle-centric enterprise environments to synchronize data between heterogeneous databases. The vulnerability resides in the Libraries component - a shared internal subsystem likely used by multiple GoldenGate processes. The 'Authentication Bypass' tag (from ENISA EUVD-2026-47290) indicates that despite requiring a high-privileged attacker (PR:H), the flaw may allow circumvention of an internal authorization or validation mechanism within the Libraries layer, enabling access to data that even a privileged account should not reach. No CWE is assigned, which limits root-cause classification; however, authentication bypass flaws in library components commonly stem from improper access control (CWE-284), missing authorization checks (CWE-862), or incorrect trust boundary enforcement. The local-only attack vector (AV:L) confirms the exploitation path is confined to the host running GoldenGate infrastructure, requiring an attacker with an authenticated OS-level session.

RemediationAI

The primary remediation is to apply Oracle's July 2026 Critical Patch Update (CPU), available via Oracle's patch delivery portal referenced at https://www.oracle.com/security-alerts/cpujul2026.html. No exact fixed version number was published in the available intelligence sources; the patched version should be confirmed directly from Oracle My Oracle Support or the CPU advisory before deployment. As a compensating control while patching is scheduled, organizations should audit and restrict which accounts hold high-privilege access to the GoldenGate infrastructure host, as PR:H is a hard prerequisite for exploitation - reducing the pool of users with that access level directly reduces exploitability. Additionally, monitoring GoldenGate process behavior for unexpected crashes or unusual data access patterns can serve as a detection layer. Because UI:R is required, reviewing which users interact with GoldenGate in ways that could be triggered by a malicious insider is advisable. Disabling unused GoldenGate Libraries sub-features is a potential but low-confidence mitigation given that the exact sub-component is not identified in available data.