CVE-2026-60394
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk27th percentile - higher than 27% of all known CVEs
Summary
Vulnerability in Oracle GoldenGate (Admin Server Executable). An unauthenticated attacker with network access via HTTPS can read a subset of data.
Risk Assessment
Risk of confidential data leakage from Oracle GoldenGate.
Recommendation
Apply the latest Oracle patches for versions 21.3-21.21 and 23.4-23.26.1.
Other vulnerabilities in Oracle GoldenGate
See all- CVE-2026-101601Medium
Vulnerability in Oracle GoldenGate (Vendor Access Module component) affects versions 21.3-21.23. An easily exploitable local attack by a low-privileged user with logon to the infrastructure can result in unauthorized access to critical data or complete access to all GoldenGate data.
- CVE-2026-91547Medium
Vulnerability in Oracle GoldenGate (Vendor Access Module component) affecting versions 19.1.0.0.0-19.32.0.0, 21.3-21.23 and 23.4-23.26.3.0.0. A low-privileged attacker with logon access to the infrastructure can gain unauthorized access to critical data. CVSS 5.5.
- CVE-2026-91530Medium
Vulnerability in Oracle GoldenGate (Admin Client Executable component) affecting versions 23.4–23.26.2.0.0. A high-privileged attacker with network access via HTTP can, under difficult conditions, gain unauthorized access to critical data or all data accessible in Oracle GoldenGate.
- CVE-2026-87351High
Vulnerability in Oracle GoldenGate (component: Admin Server Executable) affects versions 19.1.0.0.0-19.32.0.0, 21.3-21.23, and 23.4-23.26.3.0.0. An easily exploitable flaw allows a low-privileged attacker with network access via HTTPS to compromise Oracle GoldenGate.
- CVE-2026-61106High
Vulnerability in Oracle GoldenGate (Config Service Executable component) versions 23.4-23.26.2. Difficult to exploit, allows an unauthenticated attacker with network access via HTTP to take over the system.
- CVE-2026-61084Medium
Vulnerability in Oracle GoldenGate (component: Libraries) in versions 19.1.0.0.0-19.30.0.0, 21.3-21.21, and 23.4-23.26.2. A low-privileged attacker with local access can gain unauthorized read and write access to some data.
- CVE-2026-61079Medium
Vulnerability in Oracle GoldenGate (component: Libraries). Affects versions 19.1.0.0.0-19.30.0.0, 21.3-21.21 and 23.4-23.26.2. High privileged attacker with logon and human interaction can gain full data access, modify data, or cause DOS.
- CVE-2026-60570High
Vulnerability in Oracle GoldenGate (Libraries component) allows a low-privileged attacker with local access to easily take over the application.
- CVE-2026-60400High
Vulnerability in Oracle GoldenGate (component: Admin Server Executable). Affected versions are 19.1.0.0.0-19.30.0.0, 21.3-21.21, and 23.4-23.26.1. An easily exploitable vulnerability allows a low-privileged attacker with network access via HTTPS to compromise Oracle GoldenGate.
- CVE-2026-60399Medium
Vulnerability in Oracle GoldenGate (component: Receiver Service Executable). Affects versions 19.1.0.0.0-19.30.0.0, 21.3-21.21, and 23.4-23.26.1. A low-privileged attacker with network access via HTTP can cause a complete denial of service (complete DOS).
Original NVD description (English source)
Vulnerability in Oracle GoldenGate (component: Admin Server Executable). Supported versions that are affected are 21.3-21.21 and 23.4-23.26.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle GoldenGate. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle GoldenGate accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).
Vulnerability data from NVD (NIST) · CISA KEV · EPSS