What is the CVSS score of CVE-2026-60400?

CVE-2026-60400 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Oracle GoldenGate are affected by CVE-2026-60400?

Oracle GoldenGate Admin Server Executable versions 19c-23ai contains a privilege escalation vulnerability (CVSS 8.8) allowing authenticated, network-adjacent users with minimal system privileges to…

How to fix or mitigate CVE-2026-60400?

Within 24 hours, inventory all Oracle GoldenGate Admin Server deployments running versions 19.1.0.0.0-19.30.0.0, 21.3-21.21, or 23.4-23.26.1. Within 7 days, download and validate the Oracle Critical Patch Update July 2026 in a non-production environment, and develop a phased deployment plan prioritizing systems exposed to broader networks. Within 30 days, complete patch deployment to all affected instances, with priority given to production environments handling sensitive data.

Oracle GoldenGate CVE-2026-60400

EUVD-2026-46802 HIGH

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-9q5v-q9fp-gvf4

Oracle Authentication Bypass Goldengate

8.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network HTTPS reach and low complexity, but a low-privilege account is required (PR:L), yielding full C/I/A takeover with unchanged scope.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 03:24 vuln.today

CVE Published

Jul 21, 2026 - 22:17 nvd

HIGH 8.8

DescriptionCVE.org

Vulnerability in Oracle GoldenGate (component: Admin Server Executable). Supported versions that are affected are 19.1.0.0.0-19.30.0.0, 21.3-21.21 and 23.4-23.26.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTPS to compromise Oracle GoldenGate. Successful attacks of this vulnerability can result in takeover of Oracle GoldenGate. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Privilege escalation to full product takeover in Oracle GoldenGate (Admin Server Executable) lets a low-privileged, network-adjacent attacker seize complete control of the GoldenGate instance over HTTPS. Affected releases span the 19c (19.1.0.0.0-19.30.0.0), 21c (21.3-21.21), and 23ai (23.4-23.26.1) branches, and Oracle rates the impact 8.8 with full confidentiality, integrity, and availability loss. There is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV, but a fix is delivered in the Oracle Critical Patch Update of July 2026.

Technical ContextAI

Oracle GoldenGate is a real-time data replication, change-data-capture, and integration platform used to move transactional data between heterogeneous databases and environments. The vulnerable component is the Admin Server Executable - the management/control-plane service of the GoldenGate Microservices Architecture, which exposes an HTTPS administrative interface (the deployment's REST/Admin API and web console) used to configure and operate extract/replicat processes. Oracle lists the CWE as N/A, so no specific root-cause weakness class is published, but the CVSS profile (network HTTPS vector, low privileges required, unchanged scope, total C/I/A impact) is consistent with an authenticated-but-low-privilege user escalating within the Admin Server to gain administrative control of the deployment.

RemediationAI

Apply the Oracle Critical Patch Update for July 2026, which contains the fix for this issue - Patch available per vendor advisory (https://www.oracle.com/security-alerts/cpujul2026.html); the input does not specify an exact fixed build number, so consult that advisory for the precise patched release for your 19c, 21c, or 23ai deployment and upgrade beyond the listed affected ranges (19.30.0.0, 21.21, and 23.26.1 respectively). Until patched, reduce exposure by restricting network reachability of the GoldenGate Admin Server HTTPS interface to trusted management networks or a bastion/jump host and placing it behind a firewall or VPN, which limits which hosts can reach the vulnerable endpoint at the cost of remote administrative convenience. Because exploitation requires a low-privileged account, tighten and audit GoldenGate user accounts and credentials, remove unnecessary low-privilege logins, and rotate credentials to shrink the pool of accounts that could stage the escalation.