Oracle GoldenGate CVE-2026-60399

Exploitation requires network access to the GoldenGate Receiver Service Executable over HTTP and authentication at a low privilege level (PR:L per CVSS vector). The attacker must hold valid credentials sufficient to interact with the Receiver Service endpoint - anonymous, unauthenticated exploitation is not indicated by the PR:L vector. No special non-default configuration is described as required; the vulnerability appears to reside in the standard Receiver Service HTTP handling path. Limiting factors: the authentication gate (PR:L) excludes unauthenticated internet attackers; the Receiver Service is typically only reachable within internal replication network segments rather than publicly exposed; and impact is limited exclusively to availability with no confidentiality or integrity consequence. Organizations that restrict Receiver Service port access to known Extract hosts reduce exploitability to near-zero.

The CVSS 3.1 score of 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) accurately reflects the attack profile: network-reachable, low complexity, but gated behind low-level authentication, with purely availability impact and no scope change. This is not a trivial risk for organizations running GoldenGate in production data pipelines - a complete crash or hang of the Receiver Service halts data replication, which can trigger downstream data inconsistency, failed batch jobs, or SLA breaches in financial and operational systems. However, the PR:L requirement means an anonymous internet attacker cannot exploit this without credentials, meaningfully narrowing the realistic threat pool to insider threats, compromised service accounts, or attackers who have already achieved initial access. No EPSS data was provided in the input; no KEV listing exists; no POC is known. The vulnerability is therefore assessed as a prioritized patching candidate for organizations where GoldenGate Receiver Services are exposed on internal networks to multiple authenticated users, but not an emergency response item absent exploitation evidence.

An attacker who holds a low-privileged account with HTTP access to the GoldenGate Receiver Service - such as a rogue database operator, a compromised service account, or an insider threat - sends a crafted HTTP request to the Receiver Service Executable. The malformed or resource-exhausting request triggers a hang or crash of the Receiver process, halting replication between source and target databases. The attacker can repeat this to prevent service recovery, causing prolonged data pipeline outages.