PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-60395 Oracle Corporation CVE debrief

AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-07-21T22:17:41.940Z and has not been modified since then. This vulnerability affects Oracle GoldenGate versions 19.1.0.0.0-19.30.0.0, 21.3-21.21, and 23.4-23.26.1, allowing low-privileged attackers with network access via HTTP to compromise Oracle GoldenGate and gain unauthorized read access to a subset of accessible data. The CVSS score is 4.3, indicating a medium severity vulnerability. Organizations should review and apply Oracle's security patches and implement additional security measures to protect sensitive data. It is recommended to restrict network access to the Admin Server Executable, monitor for suspicious activity, and verify inventory of Oracle GoldenGate installations and their versions.

Vendor
Oracle Corporation
Product
Oracle GoldenGate
CVSS
MEDIUM 4.3
CISA KEV
Not listed in stored evidence
Original CVE published
2026-07-21
Original CVE updated
2026-07-31
Advisory published
2026-07-21
Advisory updated
2026-07-31

Who should care

Organizations using Oracle GoldenGate, especially those with low-privileged attackers with network access via HTTP, should review and apply Oracle's security patches and implement additional security measures to protect sensitive data. This includes restricting network access to the Admin Server Executable, monitoring for suspicious activity, and verifying inventory of Oracle GoldenGate installations and their versions. Security teams and vulnerability management teams should prioritize this vulnerability given its medium severity and potential impact on sensitive data access.

Technical summary

A vulnerability in Oracle GoldenGate's Admin Server Executable allows low-privileged attackers with network access via HTTP to compromise Oracle GoldenGate and gain unauthorized read access to a subset of accessible data. The CVSS score is 4.3, indicating a medium severity vulnerability. This vulnerability affects Oracle GoldenGate versions 19.1.0.0.0-19.30.0.0, 21.3-21.21, and 23.4-23.26.1. It is recommended to review and apply Oracle's security patches for Oracle GoldenGate and implement additional security measures to protect sensitive data.

Defensive priority

Medium priority given the CVSS score of 4.3 and the potential for unauthorized read access to Oracle GoldenGate data.

Recommended defensive actions

  • Review and apply Oracle's security patches for Oracle GoldenGate
  • Restrict network access to the Admin Server Executable
  • Monitor for suspicious activity and implement compensating controls
  • Verify inventory of Oracle GoldenGate installations and their versions
  • Implement additional security measures to protect sensitive data

Evidence notes

The evidence from the NVD and Oracle indicates a vulnerability in Oracle GoldenGate's Admin Server Executable, allowing low-privileged attackers with network access via HTTP to compromise Oracle GoldenGate and gain unauthorized read access to a subset of accessible data. Further review of system logs and monitoring for suspicious activity is recommended to verify the integrity of affected systems. Additionally, defenders should verify inventory of Oracle GoldenGate installations and their versions, and implement additional security measures to protect sensitive data.

Official resources

AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-07-21T22:17:41.940Z and has not been modified since then.