CVE-2026-60394
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk25th percentile - higher than 25% of all known CVEs
Summary
Vulnerability in Oracle GoldenGate (Admin Server Executable). An unauthenticated attacker with network access via HTTPS can read a subset of data.
Risk Assessment
Risk of confidential data leakage from Oracle GoldenGate.
Recommendation
Apply the latest Oracle patches for versions 21.3-21.21 and 23.4-23.26.1.
Other vulnerabilities in Oracle GoldenGate
See all- CVE-2026-61106High
Vulnerability in Oracle GoldenGate (Config Service Executable component) versions 23.4-23.26.2. Difficult to exploit, allows an unauthenticated attacker with network access via HTTP to take over the system.
- CVE-2026-61084Medium
Vulnerability in Oracle GoldenGate (component: Libraries) in versions 19.1.0.0.0-19.30.0.0, 21.3-21.21, and 23.4-23.26.2. A low-privileged attacker with local access can gain unauthorized read and write access to some data.
- CVE-2026-61079Medium
Vulnerability in Oracle GoldenGate (component: Libraries). Affects versions 19.1.0.0.0-19.30.0.0, 21.3-21.21 and 23.4-23.26.2. High privileged attacker with logon and human interaction can gain full data access, modify data, or cause DOS.
- CVE-2026-60570High
Vulnerability in Oracle GoldenGate (Libraries component) allows a low-privileged attacker with local access to easily take over the application.
- CVE-2026-60400High
Vulnerability in Oracle GoldenGate (component: Admin Server Executable). Affected versions are 19.1.0.0.0-19.30.0.0, 21.3-21.21, and 23.4-23.26.1. An easily exploitable vulnerability allows a low-privileged attacker with network access via HTTPS to compromise Oracle GoldenGate.
- CVE-2026-60399Medium
Vulnerability in Oracle GoldenGate (component: Receiver Service Executable). Affects versions 19.1.0.0.0-19.30.0.0, 21.3-21.21, and 23.4-23.26.1. A low-privileged attacker with network access via HTTP can cause a complete denial of service (complete DOS).
- CVE-2026-60398High
Vulnerability in Oracle GoldenGate (Oracle GoldenGate Microservices component) allows a low-privileged attacker to take over the system over the network via HTTP. Versions 19.1.0.0.0-19.30.0.0, 21.3-21.21, and 23.4-23.26.1 are affected.
- CVE-2026-60397Medium
Vulnerability in Oracle GoldenGate (Admin Server Executable) versions 19.1.0.0.0-19.30.0.0, 21.3-21.21, and 23.4-23.26.1. Easily exploitable by an unauthenticated attacker with access to the physical communication segment. Successful attack may cause partial denial of service. CVSS 4.3 (Availability impacts).
- CVE-2026-60396High
Vulnerability in Oracle GoldenGate (component: Distribution Server executable). Affected versions are 21.3-21.21 and 23.4-23.26.1. Easily exploitable vulnerability allows high privileged attacker with network access via HTTPS to take over the system.
- CVE-2026-60395Medium
In Oracle GoldenGate (versions 19.1.0.0.0-19.30.0.0, 21.3-21.21, 23.4-23.26.1), there is an easily exploitable vulnerability in the Admin Server component. A low-privileged attacker with network access via HTTP can gain unauthorized read access to a subset of data.
Original NVD description (English source)
Vulnerability in Oracle GoldenGate (component: Admin Server Executable). Supported versions that are affected are 21.3-21.21 and 23.4-23.26.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle GoldenGate. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle GoldenGate accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).