Oracle GoldenGate CVE-2026-60396

Exploitation requires the attacker to already hold high privileges on Oracle GoldenGate (CVSS PR:H) and to have network access to the Distribution Server executable over its HTTPS interface; no end-user interaction is needed (UI:N) and attack complexity is low (AC:L). The specific limiting factor is the PR:H prerequisite - this is not exploitable by an anonymous/unauthenticated remote attacker, so a valid privileged GoldenGate account (or hijack of one) is mandatory, and only the GoldenGate Microservices Distribution Server component (versions 21.3-21.21 and 23.4-23.26.1) is affected. Realistic risk is therefore bounded by how well privileged GoldenGate accounts and the Distribution Server's HTTPS endpoint are segmented and controlled.

The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, score 7.2) describes a network-reachable, low-complexity attack that nonetheless requires high privileges (PR:H) - meaning the attacker must already hold elevated GoldenGate/administrative access before this becomes exploitable, which substantially limits the realistic attacker population and downgrades this from a mass-exploitation candidate to a privilege-abuse/escalation concern. No EPSS score, KEV listing, POC, or SSVC decision data was provided, so exploitation probability cannot be quantified; the absence of KEV and any public exploit suggests this is not currently under active or widespread exploitation. The main tension in the data is the Oracle tag 'Information Disclosure' versus the full C/I/A 'takeover' impact in the vector - the vector should be treated as authoritative for severity, but the exact weakness remains unverified because CWE is N/A. Overall this is a genuine but privilege-gated 'High' issue: prioritize patching on internet- or broadly-network-exposed Distribution Servers, but it is not a drop-everything unauthenticated RCE.

An attacker who has already obtained high-privileged GoldenGate credentials (e.g., a rogue or compromised administrator/operator account) connects to the Distribution Server over its HTTPS interface and issues crafted requests that abuse the vulnerable component to gain full control of the GoldenGate instance. With takeover achieved, they can manipulate or exfiltrate replicated trail data and disrupt replication across connected databases. No public POC is identified, so exploitation would currently require independent development.