What is the CVSS score of CVE-2026-61084?

CVE-2026-61084 has a CVSS 3.1 base score of 4.4 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N. EPSS exploitation probability: 0.1%.

Oracle GoldenGate CVE-2026-61084

EUVD-2026-47295 MEDIUM

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-2vg3-xrfw-fx8c

Authentication Bypass Oracle Goldengate

4.4

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

4.4 MEDIUM

AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

vuln.today AI

4.4 MEDIUM

Local OS access with low privileges required to reach Libraries component; limited read and write data impact with no availability or scope change aligns with vendor-provided vector.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 08:24 vuln.today

DescriptionCVE.org

Vulnerability in Oracle GoldenGate (component: Libraries). Supported versions that are affected are 19.1.0.0.0-19.30.0.0, 21.3-21.21 and 23.4-23.26.2. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle GoldenGate executes to compromise Oracle GoldenGate. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle GoldenGate accessible data as well as unauthorized read access to a subset of Oracle GoldenGate accessible data. CVSS 3.1 Base Score 4.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N).

AnalysisAI

Local privilege abuse in Oracle GoldenGate's Libraries component allows low-privileged OS users on the GoldenGate host to read and modify a subset of GoldenGate-accessible data without proper authorization. Three major version branches are affected - 19.x, 21.x, and 23.x - covering a broad deployment window documented in Oracle's Critical Patch Update for July 2026. No public exploit or active exploitation has been identified at time of analysis; the moderate CVSS 4.4 score correctly reflects the local-only attack vector and constrained data impact.

Technical ContextAI

Oracle GoldenGate is an enterprise real-time data replication and integration platform commonly deployed alongside Oracle Database environments to support high-availability, migration, and heterogeneous replication scenarios. The vulnerable component is the GoldenGate Libraries subsystem. No CWE is assigned in the source data, which limits root-cause classification; however, the 'Authentication Bypass' tag in the intelligence metadata suggests the flaw involves improper enforcement of authorization checks or access controls within the local library layer rather than a memory-safety or injection issue. The CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U) confirms that the vulnerability is exercisable only from a local authenticated OS session on the GoldenGate host - no network-facing attack surface is exposed. Affected version ranges per Oracle CPU July 2026 and ENISA EUVD-2026-47295 are: 19.1.0.0.0 through 19.30.0.0, 21.3 through 21.21, and 23.4 through 23.26.2.

RemediationAI

Oracle released fixes for this vulnerability as part of the Critical Patch Update for July 2026; organizations should consult the advisory at https://www.oracle.com/security-alerts/cpujul2026.html to identify the exact patched release applicable to their version stream (19.x, 21.x, or 23.x). The precise fixed version numbers are not independently confirmed beyond Oracle's CPU documentation. For environments unable to patch immediately, the most effective compensating control is restricting local OS logon access to the GoldenGate host strictly to authorized GoldenGate administrators and database operators, since the local attack vector (AV:L) means that removing shell access for untrusted OS accounts eliminates the attack surface entirely - note this may affect operational workflows for teams with shared server access. Additionally, audit all OS-level accounts with logon rights to GoldenGate infrastructure and enforce least-privilege OS account policies. No specific GoldenGate feature disable or network-layer mitigation applies given the local-only attack vector.