CVE-2026-34273
Unauthorized Read Access via HTTP in Oracle GoldenGate Libraries
Publication date: 2026-04-21
Last updated on: 2026-04-27
Assigner: Oracle
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| oracle | goldengate | From 23.4 (inc) to 23.10 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-200 | The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the Libraries component of Oracle GoldenGate versions 23.4 through 23.10. It is easily exploitable by an unauthenticated attacker who has network access via HTTP. The attacker can compromise Oracle GoldenGate and gain unauthorized read access to some of the data accessible through Oracle GoldenGate.
How can this vulnerability impact me? :
The impact of this vulnerability is unauthorized read access to a subset of data accessible by Oracle GoldenGate. This means sensitive or confidential information could be exposed to attackers without proper authorization. However, the vulnerability does not affect data integrity or availability.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
This vulnerability allows an unauthenticated attacker with network access via HTTP to gain unauthorized read access to a subset of Oracle GoldenGate accessible data.
Such unauthorized data access could potentially impact compliance with data protection regulations like GDPR and HIPAA, which require strict controls on unauthorized access to sensitive data.
However, the provided information does not specify the nature or sensitivity of the data exposed, nor does it explicitly address compliance implications.