CVE-2026-60157
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk37th percentile - higher than 37% of all known CVEs
Summary
Vulnerability in Oracle GoldenGate (component: Service Manager) allows a low-privileged attacker with network access via HTTP to compromise the system. No user interaction is required.
Risk Assessment
Risk of full takeover of Oracle GoldenGate, potentially leading to disruption of data replication, data leakage, or modification.
Recommendation
Apply the Oracle patch for versions 19.1.0.0.0-19.29.0.0, 21.3-21.21, and 23.4-23.26.1.0.0. Restrict access to the Service Manager interface.
Other vulnerabilities in Oracle GoldenGate
See all- CVE-2026-101601Medium
Vulnerability in Oracle GoldenGate (Vendor Access Module component) affects versions 21.3-21.23. An easily exploitable local attack by a low-privileged user with logon to the infrastructure can result in unauthorized access to critical data or complete access to all GoldenGate data.
- CVE-2026-91547Medium
Vulnerability in Oracle GoldenGate (Vendor Access Module component) affecting versions 19.1.0.0.0-19.32.0.0, 21.3-21.23 and 23.4-23.26.3.0.0. A low-privileged attacker with logon access to the infrastructure can gain unauthorized access to critical data. CVSS 5.5.
- CVE-2026-91530Medium
Vulnerability in Oracle GoldenGate (Admin Client Executable component) affecting versions 23.4–23.26.2.0.0. A high-privileged attacker with network access via HTTP can, under difficult conditions, gain unauthorized access to critical data or all data accessible in Oracle GoldenGate.
- CVE-2026-87351High
Vulnerability in Oracle GoldenGate (component: Admin Server Executable) affects versions 19.1.0.0.0-19.32.0.0, 21.3-21.23, and 23.4-23.26.3.0.0. An easily exploitable flaw allows a low-privileged attacker with network access via HTTPS to compromise Oracle GoldenGate.
- CVE-2026-61106High
Vulnerability in Oracle GoldenGate (Config Service Executable component) versions 23.4-23.26.2. Difficult to exploit, allows an unauthenticated attacker with network access via HTTP to take over the system.
- CVE-2026-61084Medium
Vulnerability in Oracle GoldenGate (component: Libraries) in versions 19.1.0.0.0-19.30.0.0, 21.3-21.21, and 23.4-23.26.2. A low-privileged attacker with local access can gain unauthorized read and write access to some data.
- CVE-2026-61079Medium
Vulnerability in Oracle GoldenGate (component: Libraries). Affects versions 19.1.0.0.0-19.30.0.0, 21.3-21.21 and 23.4-23.26.2. High privileged attacker with logon and human interaction can gain full data access, modify data, or cause DOS.
- CVE-2026-60570High
Vulnerability in Oracle GoldenGate (Libraries component) allows a low-privileged attacker with local access to easily take over the application.
- CVE-2026-60400High
Vulnerability in Oracle GoldenGate (component: Admin Server Executable). Affected versions are 19.1.0.0.0-19.30.0.0, 21.3-21.21, and 23.4-23.26.1. An easily exploitable vulnerability allows a low-privileged attacker with network access via HTTPS to compromise Oracle GoldenGate.
- CVE-2026-60399Medium
Vulnerability in Oracle GoldenGate (component: Receiver Service Executable). Affects versions 19.1.0.0.0-19.30.0.0, 21.3-21.21, and 23.4-23.26.1. A low-privileged attacker with network access via HTTP can cause a complete denial of service (complete DOS).
Original NVD description (English source)
Vulnerability in Oracle GoldenGate (component: Service Manager). Supported versions that are affected are 19.1.0.0.0-19.29.0.0, 21.3-21.21 and 23.4-23.26.1.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle GoldenGate. Successful attacks of this vulnerability can result in takeover of Oracle GoldenGate. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
Vulnerability data from NVD (NIST) · CISA KEV · EPSS