Oracle GoldenGate CVE-2026-60570

Exploitation requires the attacker to already have local logon access (a valid low-privileged account, PR:L) to the infrastructure where Oracle GoldenGate executes; per AV:L this cannot be triggered remotely over the network and needs no user interaction (UI:N) and low attack complexity (AC:L). The affected deployment must be running Oracle GoldenGate 23.4 through 23.26.1 with the Libraries component in use. Limiting factors: the local-only vector rules out unauthenticated internet exploitation, and the requirement for a pre-existing authenticated foothold on the GoldenGate host is the primary constraint reducing real-world exposure to environments where an attacker has already achieved local access.

The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8) describes a locally exploitable, low-complexity issue requiring only low privileges and no user interaction, yielding full compromise of GoldenGate - a serious outcome but gated behind the need for an existing foothold on the host. There is no EPSS score, SSVC decision, KEV listing, or public POC in the provided data, so the practical exploitation likelihood signals are absent rather than reassuringly low; the local attack vector meaningfully constrains mass exploitation, making this a privilege-escalation/lateral-movement risk on already-accessed systems rather than an internet-facing emergency. Note a mild tension: Oracle's 'Information Disclosure' tag implies confidentiality focus, yet the vector asserts equal integrity and availability impact - treat the full-takeover framing from the vector as authoritative and verify scope with Oracle if disclosure-only behavior is expected.

An attacker who already holds a low-privileged local account on the server running Oracle GoldenGate - for example a compromised operator login or a limited service account - invokes the vulnerable Libraries code path to gain full control of the GoldenGate instance and its replicated data flows. No user interaction or network exposure is needed, but the attacker must first have logon access to the host. No public POC has been identified at time of analysis.