What is the CVSS score of CVE-2026-61106?

CVE-2026-61106 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Oracle GoldenGate are affected by CVE-2026-61106?

Oracle GoldenGate versions 23.4 through 23.26.2 contain a remote vulnerability in the Config Service enabling unauthenticated compromise with complete system takeover potential affecting…

How to fix or mitigate CVE-2026-61106?

Within 24 hours, enumerate all Oracle GoldenGate 23.4-23.26.2 systems and determine network exposure, particularly internet-facing instances and those lacking network segmentation. Within 7 days, implement firewall rules restricting Config Service access to authorized administrative networks, enable detailed audit logging on affected systems, and deploy host-based intrusion detection. Within 30 days, apply vendor patch upon release from Oracle within 48 hours of availability, or if no patch timeline is provided, implement permanent network segregation or transition to alternative database replication solutions.

Oracle GoldenGate CVE-2026-61106

EUVD-2026-47317 HIGH

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-29xj-fcrw-cwq5

Oracle Authentication Bypass Goldengate

8.1

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.1 HIGH

Unauthenticated remote HTTP access (AV:N/PR:N/UI:N) yielding full takeover justifies C/I/A:H; Oracle's 'difficult to exploit' supports AC:H, and takeover stays within the service scope (S:U).

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 00:46 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

HIGH 8.1

DescriptionCVE.org

Vulnerability in Oracle GoldenGate (component: Config Service Executable). Supported versions that are affected are 23.4-23.26.2. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle GoldenGate. Successful attacks of this vulnerability can result in takeover of Oracle GoldenGate. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Full compromise of Oracle GoldenGate 23.4 through 23.26.2 is possible via the Config Service Executable, where an unauthenticated remote attacker sending crafted HTTP traffic can achieve complete takeover with high confidentiality, integrity, and availability impact. Oracle rates this CVSS 3.1 8.1 but explicitly flags it as difficult to exploit (AC:H), and there is no public exploit identified at time of analysis and no CISA KEV listing. Despite Oracle's own tag of 'Information Disclosure,' the described outcome is a broader system takeover, not merely data leakage.

Technical ContextAI

Oracle GoldenGate is a real-time data replication, integration, and change-data-capture platform used to move transactional data between heterogeneous databases and environments. The flaw resides in the Config Service Executable, a microservice component of the modern GoldenGate (23c/'23ai' microservices) architecture that exposes configuration and administration functions over HTTP/REST. Because the affected surface is a network-facing configuration/administration service, a weakness there can undermine the trust boundary that normally protects replication configuration and credentials. Oracle did not map a CWE (CWE: N/A), so the precise root-cause class - for example authentication bypass, injection, or unsafe deserialization in the config service - cannot be confirmed from the available data; the vector (AV:N/PR:N with C:H/I:H/A:H) is most consistent with an authentication or access-control failure in the HTTP interface that yields full control of the service.

RemediationAI

Apply the fixes from Oracle's July 2026 Critical Patch Update (https://www.oracle.com/security-alerts/cpujul2026.html) - patch available per vendor advisory; an exact fixed build number beyond the 23.26.2 affected ceiling was not provided in the input, so obtain the specific patched release directly from the CPU matrix rather than assuming a version. Until patched, reduce exposure of the Config Service by restricting network access to the GoldenGate microservices/Config Service HTTP endpoints to trusted management hosts only (firewall/allowlist, or place behind a VPN/bastion), which limits the unauthenticated network reachability that this vulnerability depends on but may disrupt remote administration and automation that rely on that endpoint. Ensure TLS and any available authentication front-ends (reverse proxy with auth) protect the service, and monitor Config Service HTTP logs for anomalous requests. Do not expose GoldenGate microservices directly to the internet.