What is the CVSS score of EUVD-2026-24348?

EUVD-2026-24348 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

Oracle GoldenGate EUVD-2026-24348

| CVE-2026-34273 MEDIUM

Information Exposure (CWE-200)

2026-04-21 oracle

GHSA-jvhw-jc32-v84v

Information Disclosure Oracle Oracle Goldengate Oracle Corporation

5.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

vuln.today AI

5.3 MEDIUM

HTTP endpoint is network-reachable with no authentication required; confidentiality impact is limited to partial disclosure with no integrity or availability consequence.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 24, 2026 - 06:27 vuln.today

EUVD ID Assigned

Apr 21, 2026 - 21:01 euvd

EUVD-2026-24348

CVE Published

Apr 21, 2026 - 20:35 nvd

MEDIUM 5.3

DescriptionCVE.org

Vulnerability in Oracle GoldenGate (component: Libraries). Supported versions that are affected are 23.4-23.10. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle GoldenGate. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle GoldenGate accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).

AnalysisAI

Unauthenticated information disclosure in Oracle GoldenGate versions 23.4 through 23.10 exposes a subset of accessible data to remote attackers via HTTP, requiring no credentials or user interaction. The Libraries component contains a CWE-200 flaw that allows network-based attackers to read protected data, though impact is limited to partial confidentiality - integrity and availability are unaffected. No active exploitation has been identified (not in CISA KEV), and EPSS places exploitation probability at 0.03%, consistent with the SSVC exploitation status of none despite the automatable flag.

Technical ContextAI

Oracle GoldenGate is Oracle's enterprise real-time data integration and replication platform, used predominantly in heterogeneous database environments across financial services, telecommunications, and large enterprise data centers. The affected component is the Libraries subsystem within GoldenGate, accessible over HTTP. The root cause is CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor), meaning the software returns data to callers who have not been authenticated or authorized to receive it - a classic information leakage pattern typically manifesting as improperly gated API responses or error messages. The CPE string (cpe:2.3:a:oracle_corporation:oracle_goldengate:*:*:*:*:*:*:*:*) covers the full affected version range of 23.4 through 23.10 as defined by Oracle's April 2026 CPU.

RemediationAI

Apply Oracle's Critical Patch Update for April 2026, documented at https://www.oracle.com/security-alerts/cpuapr2026.html, which addresses this vulnerability in the GoldenGate Libraries component. An exact patched build version is not independently confirmed from available data - consult the Oracle CPU directly to identify the specific fixed release for your deployment. If immediate patching is not operationally feasible, restrict inbound HTTP access to the GoldenGate service to only trusted internal IP ranges using host-based firewall rules or network ACLs, since the attack vector is AV:N over HTTP; this does not eliminate the flaw but substantially limits the exposure surface. Note that many GoldenGate deployments reside in segmented internal networks, which may already partially mitigate network reachability without additional controls.