What is the CVSS score of CVE-2026-60157?

CVE-2026-60157 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Oracle GoldenGate are affected by CVE-2026-60157?

A critical privilege escalation vulnerability in Oracle GoldenGate Service Manager (versions 19.1-19.29, 21.3-21.21, 23.4-23.26.1) allows low-privileged attackers with HTTP network access to achieve…

How to fix or mitigate CVE-2026-60157?

Within 24 hours, inventory all Oracle GoldenGate Service Manager deployments and identify instances running affected versions (19.1.0.0.0-19.29.0.0, 21.3-21.21, 23.4-23.26.1.0.0), then document network exposure and access paths to these systems. Over the next seven days, implement network segmentation to restrict HTTP access to affected Service Manager instances to authorized administrative systems only, enforce strong authentication controls, and establish monitoring for unauthorized access or privilege escalation attempts. Within 30 days, develop and test an upgrade strategy to transition systems to unaffected versions, coordinate with Oracle support for guidance on available version paths, and prepare for rapid deployment once vendor patches become available. Maintain daily monitoring of Oracle security bulletins and CISA advisories to ensure immediate response when patches are released.

Oracle GoldenGate CVE-2026-60157

EUVD-2026-46563 HIGH

Improper Access Control (CWE-284)

2026-07-21 oracle

GHSA-7prq-c88h-2c2r

Authentication Bypass Oracle Oracle Goldengate Oracle Corporation

8.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network HTTP reach (AV:N) with low complexity and a required low-privileged account (PR:L), no user interaction, yielding full product takeover so C/I/A all High.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 21, 2026 - 23:11 vuln.today

CVE Published

Jul 21, 2026 - 21:33 nvd

HIGH 8.8

DescriptionCVE.org

Vulnerability in Oracle GoldenGate (component: Service Manager). Supported versions that are affected are 19.1.0.0.0-19.29.0.0, 21.3-21.21 and 23.4-23.26.1.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle GoldenGate. Successful attacks of this vulnerability can result in takeover of Oracle GoldenGate. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Privilege escalation to full takeover in Oracle GoldenGate Service Manager lets a low-privileged attacker with HTTP network access fully compromise the product across versions 19.1.0.0.0-19.29.0.0, 21.3-21.21, and 23.4-23.26.1.0.0. Oracle rates this easily exploitable with high confidentiality, integrity, and availability impact (CVSS 3.1 8.8). No public exploit identified at time of analysis, and it is not listed in CISA KEV.

Technical ContextAI

Oracle GoldenGate is a real-time data replication and integration platform used for change-data-capture and heterogeneous database synchronization. The flaw resides in the Service Manager, the central web-based administration component (microservices architecture, HTTP/REST) that orchestrates GoldenGate deployments and services. Because the entry point is the HTTP-facing management service, the exposure is the administrative control plane rather than the replication data path. Oracle did not assign a CWE (listed as N/A), so the precise root-cause class is unconfirmed from the input; the CVSS profile (low-privilege, low-complexity, full impact) is consistent with an authorization or access-control weakness that allows a low-privileged authenticated user to escalate to full product control.

RemediationAI

Apply the fixes delivered in the Oracle Critical Patch Update of July 2026 (https://www.oracle.com/security-alerts/cpujul2026.html); Oracle distributes GoldenGate fixes through the CPU rather than a single named point release, so consult that advisory for the exact patched build corresponding to your 19c, 21c, or 23ai branch (Patch available per vendor advisory - exact fix version not enumerated in the provided input). Until patched, reduce exposure of the Service Manager: restrict network access to its HTTP/REST management interface to trusted administrative networks or a jump host (trade-off: breaks remote/automated management from other hosts), tighten and audit GoldenGate account provisioning to minimize the number of low-privileged users who can reach the interface (since PR:L access is the exploitation prerequisite), and place the management endpoint behind a reverse proxy or VPN with strong authentication. These are compensating controls only; the CPU patch is the sole confirmed remediation.