CVE-2026-60400

{
  "id": "CVE-2026-60400",
  "sourceIdentifier": "[email protected]",
  "published": "2026-07-21T22:17:42.497",
  "lastModified": "2026-10-24T18:10:00.163",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Vulnerability in Oracle GoldenGate (component: Admin Server Executable).  Supported versions that are affected are 19.1.0.0.0-19.30.0.0, 21.3-21.21 and  23.4-23.26.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTPS to compromise Oracle GoldenGate.  Successful attacks of this vulnerability can result in takeover of Oracle GoldenGate. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)."
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad en Oracle GoldenGate (componente: ejecutable del servidor de administración). Las versiones compatibles que están afectadas son 19.1.0.0.0-19.30.0.0, 21.3-21.21 y 23.4-23.26.1. Una vulnerabilidad fácilmente explotable permite a un atacante con pocos privilegios y acceso a la red a través de HTTPS comprometer Oracle GoldenGate. Los ataques exitosos de esta vulnerabilidad pueden resultar en la toma de control de Oracle GoldenGate. Puntuación base CVSS 3.1 de 8.8 (impactos en la Confidencialidad, Integridad y Disponibilidad). Vector CVSS: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "Oracle Corporation",
          "product": "Oracle GoldenGate",
          "versions": [
            {
              "version": "19.1.0.0.0",
              "lessThanOrEqual": "19.30.0.0",
              "versionType": "custom",
              "status": "affected"
            },
            {
              "version": "21.3",
              "lessThanOrEqual": "21.21",
              "versionType": "custom",
              "status": "affected"
            },
            {
              "version": "23.4",
              "lessThanOrEqual": "23.26.1",
              "versionType": "custom",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "baseScore": 8.8,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 5.9
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-07-24T16:26:41.651816Z",
          "id": "CVE-2026-60400",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-284"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:oracle:goldengate:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "19.1.0.0.0",
              "versionEndIncluding": "19.30.0.0",
              "matchCriteriaId": "C98FDCF4-EF54-4F31-8ADB-BE25F3EC6ACF"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:oracle:goldengate:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "21.3.0",
              "versionEndIncluding": "21.21.0.0.0",
              "matchCriteriaId": "7B653233-56BD-42C1-9D97-0742A145AC27"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:oracle:goldengate:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "23.4",
              "versionEndIncluding": "23.26.1.0.0",
              "matchCriteriaId": "05103BC5-F6D9-4572-B0E8-51F372B6B0B5"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://www.oracle.com/security-alerts/cpujul2026.html",
      "source": "[email protected]",
      "tags": [
        "Vendor Advisory"
      ]
    }
  ]
}