CVE-2026-60397

Analyzed Analyzed - Analysis Complete

Oracle GoldenGate Admin Server Partial Denial of Service

Publication date: 2026-07-21

Last updated on: 2026-07-31

Assigner: Oracle

Description

Vulnerability in Oracle GoldenGate (component: Admin Server Executable). Supported versions that are affected are 19.1.0.0.0-19.30.0.0, 21.3-21.21 and 23.4-23.26.1. Easily exploitable vulnerability allows unauthenticated attacker with access to the physical communication segment attached to the hardware where the Oracle GoldenGate executes to compromise Oracle GoldenGate. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle GoldenGate. CVSS 3.1 Base Score 4.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-21

Last Modified

2026-07-31

Generated

2026-08-11

AI Q&A

2026-07-22

EPSS Evaluated

2026-08-09

NVD

CVE-2026-60397

EUVD

EUVD-2026-46799

Affected Vendors & Products

Vendor	Product	Version / Range
oracle	goldengate	From 23.4 (inc) to 23.26.1.0.0 (inc)
oracle	goldengate	From 19.1.0.0.0 (inc) to 19.30.0.0 (inc)
oracle	goldengate	From 21.3.0 (inc) to 21.21.0.0.0 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-404	The product does not release or incorrectly releases a resource before it is made available for re-use.

Attack-Flow Graph

Executive Summary

This is a vulnerability in Oracle GoldenGate's Admin Server Executable affecting versions 19.1.0.0.0-19.30.0.0, 21.3-21.21, and 23.4-23.26.1. It allows an unauthenticated attacker with access to the physical network segment where Oracle GoldenGate runs to cause a partial denial of service by exploiting this flaw.

Detection Guidance

Detection involves monitoring network traffic for unauthorized access attempts to Oracle GoldenGate Admin Server. Check for unusual processes running on the system hosting Oracle GoldenGate. Verify network segments for unexpected connections to the Oracle GoldenGate ports.

Impact Analysis

If exploited, this vulnerability could lead to disruptions in Oracle GoldenGate operations, causing partial service outages. Attackers might reduce system availability but cannot access data or execute arbitrary code.

Compliance Impact

This vulnerability does not directly impact compliance with GDPR, HIPAA, or similar standards as it only causes partial denial of service to Oracle GoldenGate without affecting data confidentiality or integrity. Compliance risks would arise only if the partial DOS disrupts data processing required by these regulations.

Mitigation Strategies

Apply the latest Oracle GoldenGate patches immediately. Restrict physical and network access to the Oracle GoldenGate server. Ensure the Admin Server is not exposed to untrusted networks. Monitor for signs of exploitation or unauthorized access.

Hi! I’m here to help you understand CVE-2026-60397. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70