CVE-2026-60157 in GoldenGate
Summary
by MITRE • 07/22/2026
Vulnerability in Oracle GoldenGate (component: Service Manager). Supported versions that are affected are 19.1.0.0.0-19.29.0.0, 21.3-21.21 and 23.4-23.26.1.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle GoldenGate. Successful attacks of this vulnerability can result in takeover of Oracle GoldenGate. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 07/22/2026
Oracle GoldenGate Service Manager contains a critical vulnerability that affects multiple version ranges including 19.1.0.0.0 through 19.29.0.0, 21.3 through 21.21, and 23.4 through 23.26.1.0.0. This vulnerability falls under the Common Weakness Enumeration category CWE-287 which deals with authentication issues, specifically improper authentication mechanisms that can lead to unauthorized access. The flaw exists within the Service Manager component of Oracle GoldenGate, which serves as a critical management interface for the data integration platform.
The technical implementation of this vulnerability stems from insufficient authentication controls within the HTTP-based service manager interface. An attacker with low privileges and network access can exploit this weakness to gain complete control over the Oracle GoldenGate system. The CVSS 3.1 scoring vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H indicates that the attack requires network connectivity, has low complexity, only requires low privilege access, does not need user interaction, affects the entire system, and results in high impact across confidentiality, integrity, and availability domains. This represents a severe threat to enterprise data integration environments where GoldenGate serves as a critical component for data replication and synchronization.
The operational impact of this vulnerability is substantial as successful exploitation leads to complete compromise of the Oracle GoldenGate service manager, enabling attackers to perform unauthorized operations including but not limited to data manipulation, service disruption, and potential lateral movement within the network. Organizations using affected versions face significant risk of data breaches, service outages, and potential regulatory compliance violations. The vulnerability's ease of exploitation makes it particularly dangerous as it can be leveraged by threat actors without requiring advanced technical skills or extensive reconnaissance.
Mitigation strategies should include immediate patching of affected Oracle GoldenGate versions to the latest supported releases that contain security fixes for this vulnerability. Organizations should also implement network segmentation to limit access to the Service Manager interface, enforce strict authentication controls including multi-factor authentication, and monitor network traffic for suspicious HTTP requests targeting the vulnerable service manager endpoints. Additionally, regular security assessments and vulnerability scanning should be conducted to identify any potential exploitation attempts or related vulnerabilities within the Oracle GoldenGate deployment. The ATT&CK framework categorizes this type of vulnerability under T1078 Valid Accounts and T1566 Phishing, as attackers may leverage compromised credentials or exploit this weakness to establish persistent access to enterprise data integration platforms.