CVE-2026-60570
HighCVSS 7.8Exploitation Probability (EPSS)
Low risk1th percentile - higher than 1% of all known CVEs
Summary
Vulnerability in Oracle GoldenGate (Libraries component) allows a low-privileged attacker with local access to easily take over the application.
Risk Assessment
Takeover of Oracle GoldenGate can lead to full compromise of replicated data, impacting confidentiality, integrity, and availability.
Recommendation
Apply the patch from Oracle for versions 23.4-23.26.1. Restrict local access to GoldenGate servers.
Other vulnerabilities in Oracle GoldenGate
See all- CVE-2026-61106High
Vulnerability in Oracle GoldenGate (Config Service Executable component) versions 23.4-23.26.2. Difficult to exploit, allows an unauthenticated attacker with network access via HTTP to take over the system.
- CVE-2026-61084Medium
Vulnerability in Oracle GoldenGate (component: Libraries) in versions 19.1.0.0.0-19.30.0.0, 21.3-21.21, and 23.4-23.26.2. A low-privileged attacker with local access can gain unauthorized read and write access to some data.
- CVE-2026-61079Medium
Vulnerability in Oracle GoldenGate (component: Libraries). Affects versions 19.1.0.0.0-19.30.0.0, 21.3-21.21 and 23.4-23.26.2. High privileged attacker with logon and human interaction can gain full data access, modify data, or cause DOS.
- CVE-2026-60400High
Vulnerability in Oracle GoldenGate (component: Admin Server Executable). Affected versions are 19.1.0.0.0-19.30.0.0, 21.3-21.21, and 23.4-23.26.1. An easily exploitable vulnerability allows a low-privileged attacker with network access via HTTPS to compromise Oracle GoldenGate.
- CVE-2026-60399Medium
Vulnerability in Oracle GoldenGate (component: Receiver Service Executable). Affects versions 19.1.0.0.0-19.30.0.0, 21.3-21.21, and 23.4-23.26.1. A low-privileged attacker with network access via HTTP can cause a complete denial of service (complete DOS).
- CVE-2026-60398High
Vulnerability in Oracle GoldenGate (Oracle GoldenGate Microservices component) allows a low-privileged attacker to take over the system over the network via HTTP. Versions 19.1.0.0.0-19.30.0.0, 21.3-21.21, and 23.4-23.26.1 are affected.
- CVE-2026-60397Medium
Vulnerability in Oracle GoldenGate (Admin Server Executable) versions 19.1.0.0.0-19.30.0.0, 21.3-21.21, and 23.4-23.26.1. Easily exploitable by an unauthenticated attacker with access to the physical communication segment. Successful attack may cause partial denial of service. CVSS 4.3 (Availability impacts).
- CVE-2026-60396High
Vulnerability in Oracle GoldenGate (component: Distribution Server executable). Affected versions are 21.3-21.21 and 23.4-23.26.1. Easily exploitable vulnerability allows high privileged attacker with network access via HTTPS to take over the system.
- CVE-2026-60395Medium
In Oracle GoldenGate (versions 19.1.0.0.0-19.30.0.0, 21.3-21.21, 23.4-23.26.1), there is an easily exploitable vulnerability in the Admin Server component. A low-privileged attacker with network access via HTTP can gain unauthorized read access to a subset of data.
- CVE-2026-60394Medium
Vulnerability in Oracle GoldenGate (Admin Server Executable). An unauthenticated attacker with network access via HTTPS can read a subset of data.
Original NVD description (English source)
Vulnerability in Oracle GoldenGate (component: Libraries). Supported versions that are affected are 23.4-23.26.1. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle GoldenGate executes to compromise Oracle GoldenGate. Successful attacks of this vulnerability can result in takeover of Oracle GoldenGate. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).