Oracle GoldenGate CVE-2026-60400

Exploitation requires network access to the Oracle GoldenGate Admin Server Executable over HTTPS and possession of low-privileged credentials on the GoldenGate deployment (CVSS PR:L), with no user interaction needed (UI:N) and low attack complexity (AC:L). The concrete prerequisites are therefore: (1) reachability of the GoldenGate Microservices Admin Server HTTPS endpoint from the attacker's network position, and (2) at least a low-privilege authenticated account. What limits exploitation is the authentication requirement - this is not an anonymous, unauthenticated compromise; an attacker with no valid account cannot exploit it directly. Affected deployments are limited to GoldenGate 19c 19.1.0.0.0-19.30.0.0, 21c 21.3-21.21, and 23ai 23.4-23.26.1.

The signals point to a genuinely high-priority patch rather than an inflated CVSS score. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 8.8) describes a network-reachable, low-complexity attack needing only low privileges and no user interaction, yielding total compromise - the kind of flaw that is trivially exploitable once an attacker holds any authenticated foothold. Countervailing that, no EPSS score was provided in the input, the CVE is not in CISA KEV, and no POC is referenced, so exploitation appears theoretical for now (no public exploit identified at time of analysis). The PR:L requirement is the main limiting factor: an attacker must already possess some low-privileged GoldenGate credential or account, so this is more of a post-authentication escalation than a fully anonymous internet-facing takeover. Because GoldenGate handles replicated production data, a successful escalation has outsized blast radius, which argues for prompt patching despite the absence of active-exploitation evidence.

An attacker who has obtained any low-privileged Oracle GoldenGate account - for example a limited operator credential or a compromised low-tier user - connects to the Admin Server's HTTPS management interface over the network and abuses the flaw to escalate to full administrative control of the deployment. From there they can alter or read replicated data flows, disrupt replication, and take over the GoldenGate instance. No public exploit code has been identified, and the low attack complexity means no unusual timing or conditions are needed once valid low-privilege access exists.