CVE-2026-60396: High severity Oracle Oracle GoldenGate vulnerability
Vulnerability in Oracle GoldenGate (component: Distribution Server executable). Supported versions that are affected are 21.3-21.21 and 23.4-23.26.1. Easily exploitable vulnerability allows high privileged attacker with network access via HTTPS to compromise Oracle GoldenGate. Successful attacks of this vulnerability can result in takeover of Oracle GoldenGate. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Restrict network access to Oracle GoldenGate Distribution Server executable (HTTPS) to reduce exposure to network-based, high-privilege exploitation attempts.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-60396?
The severity of CVE-2026-60396 is rated as high with a score of 7.2.
How do I fix CVE-2026-60396?
To fix CVE-2026-60396, apply the latest security patches provided by Oracle for Oracle GoldenGate.
Which versions of Oracle GoldenGate are affected by CVE-2026-60396?
CVE-2026-60396 affects Oracle GoldenGate versions 21.3 to 21.21 and 23.4 to 23.26.1.
What exploit vector does CVE-2026-60396 utilize?
CVE-2026-60396 can be exploited by high privileged attackers with network access via HTTPS.
What impact does CVE-2026-60396 have on Oracle GoldenGate?
CVE-2026-60396 allows attackers to compromise Oracle GoldenGate, leading to potential unauthorized access and data manipulation.