CVE-2026-60398

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-60398", "assignerOrgId": "43595867-4340-4103-b7a2-9a5208d29a85", "state": "PUBLISHED", "assignerShortName": "oracle", "dateReserved": "2026-07-08T15:51:40.534Z", "datePublished": "2026-07-21T21:35:02.134Z", "dateUpdated": "2026-07-24T16:29:11.741Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "43595867-4340-4103-b7a2-9a5208d29a85", "shortName": "oracle", "dateUpdated": "2026-07-21T21:35:02.134Z"}, "problemTypes": [{"descriptions": [{"lang": "en-US", "description": "Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle GoldenGate. Successful attacks of this vulnerability can result in takeover of Oracle GoldenGate."}]}], "affected": [{"vendor": "Oracle Corporation", "product": "Oracle GoldenGate", "versions": [{"version": "19.1.0.0.0", "status": "affected", "lessThanOrEqual": "19.30.0.0", "versionType": "custom"}, {"version": "21.3", "status": "affected", "lessThanOrEqual": "21.21", "versionType": "custom"}, {"version": "23.4", "status": "affected", "lessThanOrEqual": "23.26.1", "versionType": "custom"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:oracle:goldengate:*:*:*:*:*:*:*:*", "versionStartIncluding": "19.1.0.0.0", "versionEndIncluding": "19.30.0.0"}, {"vulnerable": true, "criteria": "cpe:2.3:a:oracle:goldengate:*:*:*:*:*:*:*:*", "versionStartIncluding": "21.3", "versionEndIncluding": "21.21"}, {"vulnerable": true, "criteria": "cpe:2.3:a:oracle:goldengate:*:*:*:*:*:*:*:*", "versionStartIncluding": "23.4", "versionEndIncluding": "23.26.1"}]}]}], "descriptions": [{"lang": "en-US", "value": "Vulnerability in Oracle GoldenGate (component: Oracle GoldenGate Microservices). Supported versions that are affected are 19.1.0.0.0-19.30.0.0, 21.3-21.21 and 23.4-23.26.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle GoldenGate. Successful attacks of this vulnerability can result in takeover of Oracle GoldenGate. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)."}], "references": [{"url": "https://www.oracle.com/security-alerts/cpujul2026.html", "name": "Oracle Advisory", "tags": ["vendor-advisory"]}], "metrics": [{"cvssV3_1": {"attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH", "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH"}}]}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-306", "lang": "en", "description": "CWE-306 Missing Authentication for Critical Function"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-07-24T16:28:45.634816Z", "id": "CVE-2026-60398", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-24T16:29:11.741Z"}}]}}

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-60398", "assignerOrgId": "43595867-4340-4103-b7a2-9a5208d29a85", "state": "PUBLISHED", "assignerShortName": "oracle", "dateReserved": "2026-07-08T15:51:40.534Z", "datePublished": "2026-07-21T21:35:02.134Z", "dateUpdated": "2026-07-24T16:29:11.741Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "43595867-4340-4103-b7a2-9a5208d29a85", "shortName": "oracle", "dateUpdated": "2026-07-21T21:35:02.134Z"}, "problemTypes": [{"descriptions": [{"lang": "en-US", "description": "Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle GoldenGate. Successful attacks of this vulnerability can result in takeover of Oracle GoldenGate."}]}], "affected": [{"vendor": "Oracle Corporation", "product": "Oracle GoldenGate", "versions": [{"version": "19.1.0.0.0", "status": "affected", "lessThanOrEqual": "19.30.0.0", "versionType": "custom"}, {"version": "21.3", "status": "affected", "lessThanOrEqual": "21.21", "versionType": "custom"}, {"version": "23.4", "status": "affected", "lessThanOrEqual": "23.26.1", "versionType": "custom"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:oracle:goldengate:*:*:*:*:*:*:*:*", "versionStartIncluding": "19.1.0.0.0", "versionEndIncluding": "19.30.0.0"}, {"vulnerable": true, "criteria": "cpe:2.3:a:oracle:goldengate:*:*:*:*:*:*:*:*", "versionStartIncluding": "21.3", "versionEndIncluding": "21.21"}, {"vulnerable": true, "criteria": "cpe:2.3:a:oracle:goldengate:*:*:*:*:*:*:*:*", "versionStartIncluding": "23.4", "versionEndIncluding": "23.26.1"}]}]}], "descriptions": [{"lang": "en-US", "value": "Vulnerability in Oracle GoldenGate (component: Oracle GoldenGate Microservices). Supported versions that are affected are 19.1.0.0.0-19.30.0.0, 21.3-21.21 and 23.4-23.26.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle GoldenGate. Successful attacks of this vulnerability can result in takeover of Oracle GoldenGate. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)."}], "references": [{"url": "https://www.oracle.com/security-alerts/cpujul2026.html", "name": "Oracle Advisory", "tags": ["vendor-advisory"]}], "metrics": [{"cvssV3_1": {"attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH", "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH"}}]}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-60398", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-07-24T16:28:45.634816Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-306", "description": "CWE-306 Missing Authentication for Critical Function"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-24T16:29:04.170Z"}}]}}

{"affected": [{"affectedData": [{"product": "Oracle GoldenGate", "vendor": "Oracle Corporation", "versions": [{"lessThanOrEqual": "19.30.0.0", "status": "affected", "version": "19.1.0.0.0", "versionType": "custom"}, {"lessThanOrEqual": "21.21", "status": "affected", "version": "21.3", "versionType": "custom"}, {"lessThanOrEqual": "23.26.1", "status": "affected", "version": "23.4", "versionType": "custom"}]}], "source": "secalert_us@oracle.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:oracle:goldengate:*:*:*:*:*:*:*:*", "matchCriteriaId": "C98FDCF4-EF54-4F31-8ADB-BE25F3EC6ACF", "versionEndIncluding": "19.30.0.0", "versionStartIncluding": "19.1.0.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:oracle:goldengate:*:*:*:*:*:*:*:*", "matchCriteriaId": "7B653233-56BD-42C1-9D97-0742A145AC27", "versionEndIncluding": "21.21.0.0.0", "versionStartIncluding": "21.3.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:oracle:goldengate:*:*:*:*:*:*:*:*", "matchCriteriaId": "05103BC5-F6D9-4572-B0E8-51F372B6B0B5", "versionEndIncluding": "23.26.1.0.0", "versionStartIncluding": "23.4", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Vulnerability in Oracle GoldenGate (component: Oracle GoldenGate Microservices). Supported versions that are affected are 19.1.0.0.0-19.30.0.0, 21.3-21.21 and 23.4-23.26.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle GoldenGate. Successful attacks of this vulnerability can result in takeover of Oracle GoldenGate. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)."}, {"lang": "es", "value": "Vulnerabilidad en Oracle GoldenGate (componente: Oracle GoldenGate Microservices). Las versiones compatibles que est\u00e1n afectadas son 19.1.0.0.0-19.30.0.0, 21.3-21.21 y 23.4-23.26.1. Una vulnerabilidad f\u00e1cilmente explotable permite a un atacante con pocos privilegios y acceso a la red v\u00eda HTTP comprometer Oracle GoldenGate. Los ataques exitosos de esta vulnerabilidad pueden resultar en la toma de control de Oracle GoldenGate. Puntuaci\u00f3n Base CVSS 3.1 de 8.8 (impactos en la Confidencialidad, Integridad y Disponibilidad). Vector CVSS: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)."}], "id": "CVE-2026-60398", "lastModified": "2026-10-24T18:10:00.163", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "secalert_us@oracle.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-60398", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-07-24T16:28:45.634816Z", "version": "2.0.3"}}]}, "published": "2026-07-21T22:17:42.277", "references": [{"source": "secalert_us@oracle.com", "tags": ["Vendor Advisory"], "url": "https://www.oracle.com/security-alerts/cpujul2026.html"}], "sourceIdentifier": "secalert_us@oracle.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-306"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[19.1.0.0.0,19.30.0.0]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[21.3,21.21]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[23.4,23.26.1]"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Oracle GoldenGate", "source": "cna", "vendor": "Oracle Corporation"}, "product": "goldengate", "vendor": "oracle"}], "created": "2026-07-22T08:15:12.991723+00:00", "title": "Remote Code Execution Vulnerability in Oracle GoldenGate Microservices via Unvalidated HTTP Input", "updated": "2026-08-02T22:45:17.186591+00:00", "vendors": ["oracle", "oracle$PRODUCT$goldengate"]}