What is the CVSS score of CVE-2026-60570?

CVE-2026-60570 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Oracle GoldenGate are affected by CVE-2026-60570?

Oracle GoldenGate 23.4 through 23.26.1 is vulnerable to privilege escalation by authorized system users, enabling complete takeover of critical database replication infrastructure.

How to fix or mitigate CVE-2026-60570?

Within 24 hours: inventory all systems running Oracle GoldenGate 23.4-23.26.1 and document which are production-critical and which users have local access. Within 7 days: implement strict local access controls restricting GoldenGate system logon to authorized administrators only, enable host-level privilege escalation monitoring, and establish audit logging for suspicious activity. Within 30 days: evaluate upgrade paths to patched versions once available, coordinate with Oracle for remediation timelines, and implement network segmentation to minimize blast radius if local compromise occurs.

Oracle GoldenGate CVE-2026-60570

EUVD-2026-46932 HIGH

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-pg38-rgfx-cf4f

Authentication Bypass Oracle Goldengate

7.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.8 HIGH

Description confirms local logon with low privileges and no user interaction leading to full GoldenGate takeover, so AV:L/PR:L with high C/I/A.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 07:34 vuln.today

CVE Published

Jul 21, 2026 - 22:17 nvd

HIGH 7.8

DescriptionCVE.org

Vulnerability in Oracle GoldenGate (component: Libraries). Supported versions that are affected are 23.4-23.26.1. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle GoldenGate executes to compromise Oracle GoldenGate. Successful attacks of this vulnerability can result in takeover of Oracle GoldenGate. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Local privilege-based takeover in Oracle GoldenGate 23.4 through 23.26.1 (Libraries component) allows a low-privileged attacker with logon access to the host running GoldenGate to fully compromise the product, with high confidentiality, integrity, and availability impact. Disclosed in Oracle's July 2026 Critical Patch Update (CVSS 3.1 base 7.8), it requires local authenticated access rather than network exploitation. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Technical ContextAI

Oracle GoldenGate is a real-time data replication and integration platform used to capture, route, and apply transactional changes across heterogeneous databases for high availability, migration, and streaming pipelines. The flaw resides in the Libraries subcomponent - the shared native/runtime libraries loaded by GoldenGate processes - which suggests a code-level defect (for example unsafe library loading, memory handling, or trust in a locally controllable input) that a local user can leverage to escalate control over the GoldenGate runtime. No CWE was assigned by Oracle or NVD, so the precise root-cause class cannot be confirmed; the Oracle tag 'Information Disclosure' points toward a confidentiality-affecting weakness, though the CVSS vector shows full high impact across all three dimensions, indicating complete takeover rather than mere disclosure.

RemediationAI

Apply the fixes delivered in Oracle's July 2026 Critical Patch Update (Patch available per vendor advisory; consult https://www.oracle.com/security-alerts/cpujul2026.html for the exact patched build for your GoldenGate 23.x deployment, as no single fixed version string was included in the source data). Because exploitation requires local logon to the host, the most effective compensating controls until patching are to tighten OS-level access: restrict interactive and service-account logon on GoldenGate servers to a minimal set of trusted administrators, enforce least privilege so low-privileged local accounts cannot run or influence GoldenGate processes, and audit filesystem permissions on GoldenGate library and installation directories to prevent tampering by non-admin users - the trade-off is added operational friction for legitimate operators. Monitor GoldenGate process and host logs for anomalous local activity as a detective control while the patch is scheduled.