What is the CVSS score of CVE-2026-60398?

CVE-2026-60398 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Oracle GoldenGate are affected by CVE-2026-60398?

Oracle GoldenGate Microservices versions 19.1.0 through 23.26.1 contain a critical vulnerability enabling complete instance takeover; no public exploit identified at time of analysis.

How to fix or mitigate CVE-2026-60398?

Within 24 hours, inventory all Oracle GoldenGate Microservices deployments, identify affected versions (19.1.0-19.30.0, 21.3-21.21, 23.4-23.26.1), and assess network exposure of HTTP interfaces. Within 7 days, restrict HTTP access to GoldenGate Microservices ports to authorized administrative networks only via firewall rules, enforce strong authentication and multi-factor authentication for all administrative accounts, and implement enhanced logging of authentication attempts and administrative API activity. Within 30 days, establish change management process for emergency patch deployment and monitor Oracle security bulletins daily for patch availability; prioritize migration planning or air-gap isolation for business-critical instances if patches are not released within 90 days.

Oracle GoldenGate CVE-2026-60398

EUVD-2026-46800 HIGH

Missing Authentication for Critical Function (CWE-306)

2026-07-21 secalert_us@oracle.com

GHSA-2mxq-qcvh-7g7w

Authentication Bypass Oracle Goldengate

8.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network HTTP-reachable management interface with low-privilege auth (PR:L) and no user interaction yields easy exploitation to full takeover, so C/I/A all High.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 03:24 vuln.today

CVE Published

Jul 21, 2026 - 22:17 nvd

HIGH 8.8

DescriptionCVE.org

Vulnerability in Oracle GoldenGate (component: Oracle GoldenGate Microservices). Supported versions that are affected are 19.1.0.0.0-19.30.0.0, 21.3-21.21 and 23.4-23.26.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle GoldenGate. Successful attacks of this vulnerability can result in takeover of Oracle GoldenGate. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Full product takeover in Oracle GoldenGate Microservices affects releases 19.1.0.0.0-19.30.0.0, 21.3-21.21, and 23.4-23.26.1, where a low-privileged attacker with HTTP network access can compromise the entire GoldenGate instance. Oracle rates this CVSS 3.1 8.8 with high confidentiality, integrity, and availability impact and flags it as easily exploitable, meaning a single authenticated foothold escalates to complete control. No public exploit identified at time of analysis, and it is not listed in CISA KEV.

Technical ContextAI

Oracle GoldenGate is a real-time data replication and integration platform used to move and synchronize data across heterogeneous databases; the affected 'Microservices' architecture exposes management and administration functions over HTTP/HTTPS REST services (Service Manager, Administration Server, Distribution/Receiver Servers). The vulnerability lives in this web-facing microservices layer, reachable over HTTP per the CVSS AV:N/PR:L vector. Oracle did not assign a CWE (CWE: N/A) and does not disclose root-cause specifics in its Critical Patch Update advisories, but the 'takeover' outcome combined with the Information Disclosure tag suggests a flaw in the authenticated management interface that allows privilege escalation or unrestricted control beyond the attacker's assigned role.

RemediationAI

Apply the fixes from the Oracle Critical Patch Update of July 2026 (https://www.oracle.com/security-alerts/cpujul2026.html); patch is available per vendor advisory, though the exact patched build numbers are not stated in the provided data and should be taken directly from that CPU matrix for your 19c, 21c, or 23ai branch. Because exploitation requires network HTTP access with low privileges, compensating controls until patching include restricting network access to the GoldenGate Microservices ports (Service Manager and the deployment web servers) to trusted management hosts via firewall or reverse-proxy allowlisting, placing the microservices behind a VPN or bastion rather than exposing them broadly, and tightening/rotating GoldenGate role accounts to minimize which low-privilege identities can reach the interface - noting these controls reduce but do not eliminate risk for any attacker who already holds valid low-privilege credentials, so they are a stopgap, not a substitute for the CPU patch.