What is the CVSS score of CVE-2026-60396?

CVE-2026-60396 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Oracle GoldenGate are affected by CVE-2026-60396?

Oracle GoldenGate versions 21.3 through 23.26.1 contain a privilege escalation vulnerability allowing high-privileged users to achieve full system compromise of the Distribution Server component.

How to fix or mitigate CVE-2026-60396?

Within 24 hours: Inventory all GoldenGate installations running versions 21.3-21.21 or 23.4-23.26.1 and identify systems with elevated-privilege user access. Within 7 days: Implement network isolation of Distribution Servers; restrict administrative access to VPN or bastion hosts; enforce strict access controls limiting high-privilege operations to authorized personnel only. Within 30 days: Monitor Oracle security advisories for patch availability; contact Oracle Support regarding timing and workarounds; establish an upgrade or transition plan for systems that cannot rely on compensating controls indefinitely.

Oracle GoldenGate CVE-2026-60396

EUVD-2026-46798 HIGH

Missing Authentication for Critical Function (CWE-306)

2026-07-21 secalert_us@oracle.com

GHSA-qxx2-5vrp-rq3m

Oracle Authentication Bypass Goldengate

7.2

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

7.2 HIGH

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.2 HIGH

Network-reachable Distribution Server over HTTPS gives AV:N/AC:L, but 'high privileged attacker' forces PR:H; full takeover yields C:H/I:H/A:H with unchanged scope.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 03:23 vuln.today

CVE Published

Jul 21, 2026 - 22:17 nvd

HIGH 7.2

DescriptionCVE.org

Vulnerability in Oracle GoldenGate (component: Distribution Server executable). Supported versions that are affected are 21.3-21.21 and 23.4-23.26.1. Easily exploitable vulnerability allows high privileged attacker with network access via HTTPS to compromise Oracle GoldenGate. Successful attacks of this vulnerability can result in takeover of Oracle GoldenGate. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Full takeover of Oracle GoldenGate is possible in versions 21.3-21.21 and 23.4-23.26.1 through the Distribution Server executable, where a high-privileged attacker reaching the server over HTTPS can fully compromise confidentiality, integrity, and availability. The flaw carries a CVSS 3.1 base score of 7.2 and requires existing elevated privileges rather than anonymous access, so it is best characterized as a privileged-user-to-full-compromise escalation within the GoldenGate management plane. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Technical ContextAI

Oracle GoldenGate is a real-time data replication and integration platform used to capture, route, and deliver transactional changes across heterogeneous databases; the affected component is the Distribution Server executable, the network service (part of the GoldenGate Microservices Architecture) responsible for distributing trail data to downstream Receiver/Replicat targets over HTTPS. Because the vulnerable surface is the Distribution Server's HTTPS-exposed control path, exploitation targets the management/distribution plane rather than a database engine directly. No CWE was assigned by NVD, so the precise weakness class (e.g., improper authorization, injection, or unsafe deserialization within the distribution service) cannot be confirmed from the supplied data; Oracle's tag of 'Information Disclosure' hints at a confidentiality element, but the CVSS vector's C:H/I:H/A:H and 'takeover' language indicate a broader impact than disclosure alone.

RemediationAI

Apply the fixes delivered in Oracle's July 2026 Critical Patch Update (Patch available per vendor advisory) documented at https://www.oracle.com/security-alerts/cpujul2026.html - Oracle CPUs ship the corrected GoldenGate builds, so upgrade affected 21.x (21.3-21.21) and 23.x (23.4-23.26.1) deployments to the CPU-patched release for their branch; the input does not list a single exact fixed build number, so confirm the target version directly in the CPU matrix rather than assuming one. As compensating controls until patching, restrict network reachability of the Distribution Server's HTTPS port to only trusted replication peers and administrative hosts via firewall/network ACLs (trade-off: may break legitimate distribution paths if peer inventory is incomplete), tighten and audit GoldenGate administrative accounts since exploitation requires high privileges - rotate credentials and remove unnecessary privileged users to shrink the eligible attacker set, and enable/monitor logging on the Distribution Server for anomalous administrative or distribution activity. Because PR:H is required, aggressive least-privilege on GoldenGate admin roles is the most effective non-patch mitigation.