CVE-2026-60399
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk23th percentile - higher than 23% of all known CVEs
Summary
Vulnerability in Oracle GoldenGate (component: Receiver Service Executable). Affects versions 19.1.0.0.0-19.30.0.0, 21.3-21.21, and 23.4-23.26.1. A low-privileged attacker with network access via HTTP can cause a complete denial of service (complete DOS).
Risk Assessment
Risk includes complete unavailability of the GoldenGate service, potentially disrupting data replication and synchronization between systems.
Recommendation
Apply the Oracle patch. Restrict access to the Receiver Service and monitor HTTP traffic.
Other vulnerabilities in Oracle GoldenGate
See all- CVE-2026-61106High
Vulnerability in Oracle GoldenGate (Config Service Executable component) versions 23.4-23.26.2. Difficult to exploit, allows an unauthenticated attacker with network access via HTTP to take over the system.
- CVE-2026-61084Medium
Vulnerability in Oracle GoldenGate (component: Libraries) in versions 19.1.0.0.0-19.30.0.0, 21.3-21.21, and 23.4-23.26.2. A low-privileged attacker with local access can gain unauthorized read and write access to some data.
- CVE-2026-61079Medium
Vulnerability in Oracle GoldenGate (component: Libraries). Affects versions 19.1.0.0.0-19.30.0.0, 21.3-21.21 and 23.4-23.26.2. High privileged attacker with logon and human interaction can gain full data access, modify data, or cause DOS.
- CVE-2026-60570High
Vulnerability in Oracle GoldenGate (Libraries component) allows a low-privileged attacker with local access to easily take over the application.
- CVE-2026-60400High
Vulnerability in Oracle GoldenGate (component: Admin Server Executable). Affected versions are 19.1.0.0.0-19.30.0.0, 21.3-21.21, and 23.4-23.26.1. An easily exploitable vulnerability allows a low-privileged attacker with network access via HTTPS to compromise Oracle GoldenGate.
- CVE-2026-60398High
Vulnerability in Oracle GoldenGate (Oracle GoldenGate Microservices component) allows a low-privileged attacker to take over the system over the network via HTTP. Versions 19.1.0.0.0-19.30.0.0, 21.3-21.21, and 23.4-23.26.1 are affected.
- CVE-2026-60397Medium
Vulnerability in Oracle GoldenGate (Admin Server Executable) versions 19.1.0.0.0-19.30.0.0, 21.3-21.21, and 23.4-23.26.1. Easily exploitable by an unauthenticated attacker with access to the physical communication segment. Successful attack may cause partial denial of service. CVSS 4.3 (Availability impacts).
- CVE-2026-60396High
Vulnerability in Oracle GoldenGate (component: Distribution Server executable). Affected versions are 21.3-21.21 and 23.4-23.26.1. Easily exploitable vulnerability allows high privileged attacker with network access via HTTPS to take over the system.
- CVE-2026-60395Medium
In Oracle GoldenGate (versions 19.1.0.0.0-19.30.0.0, 21.3-21.21, 23.4-23.26.1), there is an easily exploitable vulnerability in the Admin Server component. A low-privileged attacker with network access via HTTP can gain unauthorized read access to a subset of data.
- CVE-2026-60394Medium
Vulnerability in Oracle GoldenGate (Admin Server Executable). An unauthenticated attacker with network access via HTTPS can read a subset of data.
Original NVD description (English source)
Vulnerability in Oracle GoldenGate (component: Receiver Service Executable). Supported versions that are affected are 19.1.0.0.0-19.30.0.0, 21.3-21.21 and 23.4-23.26.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle GoldenGate. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle GoldenGate. CVSS 3.1 Base Score 6.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).