CVE-2026-60570

Analyzed Analyzed - Analysis Complete

Privilege Escalation in Oracle GoldenGate

Publication date: 2026-07-21

Last updated on: 2026-08-06

Assigner: Oracle

Description

Vulnerability in Oracle GoldenGate (component: Libraries). Supported versions that are affected are 23.4-23.26.1. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle GoldenGate executes to compromise Oracle GoldenGate. Successful attacks of this vulnerability can result in takeover of Oracle GoldenGate. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-21

Last Modified

2026-08-06

Generated

2026-08-11

AI Q&A

2026-07-22

EPSS Evaluated

2026-08-09

NVD

CVE-2026-60570

EUVD

EUVD-2026-46932

Affected Vendors & Products

Vendor	Product	Version / Range
oracle	goldengate	From 23.4 (inc) to 23.26.1.0.0 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-284	The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Attack-Flow Graph

Executive Summary

This is a vulnerability in Oracle GoldenGate, specifically in its Libraries component. It affects versions 23.4 through 23.26.1. The issue allows a low-privileged attacker with logon access to the system running Oracle GoldenGate to take over the software. The attack requires local access but can lead to full compromise of Oracle GoldenGate, impacting confidentiality, integrity, and availability.

Detection Guidance

Detection requires checking Oracle GoldenGate versions and applying Oracle's security patches. Use commands like 'ggsci version' to verify installed versions and compare against affected 23.4-23.26.1. Monitor Oracle's security advisories for updates and apply patches immediately if vulnerable.

Impact Analysis

If you use Oracle GoldenGate versions 23.4 to 23.26.1, an attacker with local access could take control of the software. This could allow them to access sensitive data processed by GoldenGate, alter or delete data, or disrupt operations. The impact includes potential data breaches, system downtime, and unauthorized changes to critical data.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR, HIPAA, and other regulations due to unauthorized access to sensitive data. GDPR requires protecting personal data, while HIPAA mandates safeguarding protected health information. A successful attack could result in data breaches, leading to legal penalties, fines, and reputational damage for organizations handling regulated data.

Mitigation Strategies

Apply the latest Oracle GoldenGate patches or updates provided by Oracle to address this vulnerability. Ensure only authorized users have logon access to the infrastructure where Oracle GoldenGate executes. Monitor Oracle security advisories for additional guidance.

Hi! I’m here to help you understand CVE-2026-60570. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70