CVE-2026-60157: High severity Oracle Oracle GoldenGate (Service Manager) vulnerability
Vulnerability in Oracle GoldenGate (component: Service Manager). Supported versions that are affected are 19.1.0.0.0-19.29.0.0, 21.3-21.21 and 23.4-23.26.1.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle GoldenGate. Successful attacks of this vulnerability can result in takeover of Oracle GoldenGate. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Oracle GoldenGate (Service Manager)to a version that resolves this vulnerability.Fixed in 19.1.0.0.0-19.29.0.0 - Upgrade
Upgrade
Oracle GoldenGate (Service Manager)to a version that resolves this vulnerability.Fixed in 21.3-21.21 - Upgrade
Upgrade
Oracle GoldenGate (Service Manager)to a version that resolves this vulnerability.Fixed in 23.4-23.26.1.0.0 - Compensating control
Restrict network access to Oracle GoldenGate Service Manager over HTTP so only trusted sources can reach it (AV:N indicates remote exploitation via HTTP).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-60157?
The severity of CVE-2026-60157 is rated high with a score of 8.8.
How can I mitigate CVE-2026-60157?
To mitigate CVE-2026-60157, ensure that your Oracle GoldenGate is updated to a version that is not affected.
What are the affected versions for CVE-2026-60157?
The affected versions for CVE-2026-60157 include Oracle GoldenGate versions 19.1.0.0.0-19.29.0.0, 21.3-21.21, and 23.4-23.26.1.0.0.
What components are vulnerable in CVE-2026-60157?
The vulnerable component in CVE-2026-60157 is the Service Manager of Oracle GoldenGate.
What type of access is required to exploit CVE-2026-60157?
CVE-2026-60157 can be exploited by a low privileged attacker with network access via HTTP.