CVE-2026-61079
MediumCVSS 5.8Exploitation Probability (EPSS)
Low risk0th percentile - higher than 0% of all known CVEs
Summary
Vulnerability in Oracle GoldenGate (component: Libraries). Affects versions 19.1.0.0.0-19.30.0.0, 21.3-21.21 and 23.4-23.26.2. High privileged attacker with logon and human interaction can gain full data access, modify data, or cause DOS.
Risk Assessment
An attacker with high privileges can gain full access to critical GoldenGate data, compromising confidentiality, integrity, and availability.
Recommendation
Apply the Oracle patch as per vendor recommendations. Restrict local access and require human interaction for sensitive operations.
Other vulnerabilities in Oracle GoldenGate
See all- CVE-2026-61106High
Vulnerability in Oracle GoldenGate (Config Service Executable component) versions 23.4-23.26.2. Difficult to exploit, allows an unauthenticated attacker with network access via HTTP to take over the system.
- CVE-2026-61084Medium
Vulnerability in Oracle GoldenGate (component: Libraries) in versions 19.1.0.0.0-19.30.0.0, 21.3-21.21, and 23.4-23.26.2. A low-privileged attacker with local access can gain unauthorized read and write access to some data.
- CVE-2026-60570High
Vulnerability in Oracle GoldenGate (Libraries component) allows a low-privileged attacker with local access to easily take over the application.
- CVE-2026-60400High
Vulnerability in Oracle GoldenGate (component: Admin Server Executable). Affected versions are 19.1.0.0.0-19.30.0.0, 21.3-21.21, and 23.4-23.26.1. An easily exploitable vulnerability allows a low-privileged attacker with network access via HTTPS to compromise Oracle GoldenGate.
- CVE-2026-60399Medium
Vulnerability in Oracle GoldenGate (component: Receiver Service Executable). Affects versions 19.1.0.0.0-19.30.0.0, 21.3-21.21, and 23.4-23.26.1. A low-privileged attacker with network access via HTTP can cause a complete denial of service (complete DOS).
- CVE-2026-60398High
Vulnerability in Oracle GoldenGate (Oracle GoldenGate Microservices component) allows a low-privileged attacker to take over the system over the network via HTTP. Versions 19.1.0.0.0-19.30.0.0, 21.3-21.21, and 23.4-23.26.1 are affected.
- CVE-2026-60397Medium
Vulnerability in Oracle GoldenGate (Admin Server Executable) versions 19.1.0.0.0-19.30.0.0, 21.3-21.21, and 23.4-23.26.1. Easily exploitable by an unauthenticated attacker with access to the physical communication segment. Successful attack may cause partial denial of service. CVSS 4.3 (Availability impacts).
- CVE-2026-60396High
Vulnerability in Oracle GoldenGate (component: Distribution Server executable). Affected versions are 21.3-21.21 and 23.4-23.26.1. Easily exploitable vulnerability allows high privileged attacker with network access via HTTPS to take over the system.
- CVE-2026-60395Medium
In Oracle GoldenGate (versions 19.1.0.0.0-19.30.0.0, 21.3-21.21, 23.4-23.26.1), there is an easily exploitable vulnerability in the Admin Server component. A low-privileged attacker with network access via HTTP can gain unauthorized read access to a subset of data.
- CVE-2026-60394Medium
Vulnerability in Oracle GoldenGate (Admin Server Executable). An unauthenticated attacker with network access via HTTPS can read a subset of data.
Original NVD description (English source)
Vulnerability in Oracle GoldenGate (component: Libraries). Supported versions that are affected are 19.1.0.0.0-19.30.0.0, 21.3-21.21 and 23.4-23.26.2. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where Oracle GoldenGate executes to compromise Oracle GoldenGate. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle GoldenGate accessible data as well as unauthorized update, insert or delete access to some of Oracle GoldenGate accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle GoldenGate. CVSS 3.1 Base Score 5.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:L/A:H).