CVE-2026-60395 Overview
CVE-2026-60395 is an information disclosure vulnerability in the Admin Server Executable component of Oracle GoldenGate. The flaw affects supported versions 19.1.0.0.0-19.30.0.0, 21.3-21.21, and 23.4-23.26.1. A low-privileged attacker with network access over HTTP can exploit this issue without user interaction. Successful exploitation grants unauthorized read access to a subset of Oracle GoldenGate accessible data. Oracle disclosed the vulnerability in the Oracle Critical Patch Update July 2026.
Critical Impact
Authenticated network attackers can read a subset of data stored or processed by Oracle GoldenGate Admin Server, exposing configuration and replication metadata.
Affected Products
- Oracle GoldenGate 19.1.0.0.0 through 19.30.0.0
- Oracle GoldenGate 21.3 through 21.21
- Oracle GoldenGate 23.4 through 23.26.1
Discovery Timeline
- 2026-07-21 - CVE-2026-60395 published to NVD as part of Oracle's July 2026 Critical Patch Update
- 2026-07-21 - Last updated in NVD database
Technical Details for CVE-2026-60395
Vulnerability Analysis
The vulnerability resides in the Admin Server Executable component of Oracle GoldenGate, the management service responsible for administering replication processes and configuration. The flaw exposes data through the HTTP interface used by the Admin Server. An attacker holding low-privilege credentials on the GoldenGate deployment can leverage the network-accessible endpoint to retrieve information they should not have authorization to view. The impact is scoped to confidentiality, with no integrity or availability consequences noted in the advisory. Oracle categorizes this as an easily exploitable weakness, meaning the attack requires no elaborate preconditions beyond network reach and valid low-tier authentication.
Root Cause
Oracle has not published the specific code-level defect. Based on the advisory language, the Admin Server fails to enforce sufficient authorization checks on one or more HTTP endpoints. Low-privileged users receive access to data that should be restricted to higher-privileged roles. This aligns with a Broken Access Control weakness pattern.
Attack Vector
The attack proceeds over the network through HTTP against the Admin Server listener. An attacker authenticates using any low-privileged Oracle GoldenGate account. Once authenticated, the attacker issues crafted HTTP requests to endpoints that expose GoldenGate configuration or replication data. No user interaction is required, and the scope remains unchanged. The EPSS score of 0.282% indicates a low current probability of observed exploitation in the wild.
No public proof-of-concept exploit is available. Refer to the Oracle Security Alert July 2026 for vendor-supplied technical details.
Detection Methods for CVE-2026-60395
Indicators of Compromise
- Unexpected HTTP requests from low-privileged GoldenGate accounts against Admin Server endpoints that return configuration or replication metadata.
- Authentication events from GoldenGate service accounts originating from unfamiliar source IP addresses or during off-hours.
- Elevated volumes of GET requests targeting Admin Server API paths from a single session.
Detection Strategies
- Enable and review Oracle GoldenGate Admin Server audit logs for enumeration patterns tied to low-privileged principals.
- Correlate HTTP access logs with role assignments to flag requests where the response returns data outside the caller's expected authorization scope.
- Baseline normal API usage per GoldenGate role and alert on deviations that resemble reconnaissance.
Monitoring Recommendations
- Forward Admin Server access and audit logs to a centralized SIEM for retention and correlation with identity telemetry.
- Monitor network traffic to Admin Server ports for unauthorized clients, and restrict traffic to management VLANs.
- Track privileged and low-privileged account activity together to identify lateral reconnaissance patterns.
How to Mitigate CVE-2026-60395
Immediate Actions Required
- Apply the July 2026 Oracle Critical Patch Update to all affected Oracle GoldenGate deployments as the primary remediation.
- Inventory GoldenGate instances across 19.x, 21.x, and 23.x release trains to confirm patch coverage.
- Rotate credentials for any low-privileged GoldenGate accounts if suspicious access was observed prior to patching.
- Restrict network reachability to the Admin Server HTTP interface to trusted management networks only.
Patch Information
Oracle addressed CVE-2026-60395 in the July 2026 Critical Patch Update. Administrators should install the corresponding GoldenGate patch levels above 19.30.0.0, 21.21, and 23.26.1 per the Oracle Security Alert July 2026.
Workarounds
- Limit Admin Server HTTP exposure to a hardened management subnet using host or network firewall rules.
- Enforce least privilege on GoldenGate roles and remove unnecessary low-privileged accounts that could be abused.
- Require TLS and strong authentication in front of the Admin Server, and place it behind a reverse proxy that adds request-level authorization checks where feasible.
# Example: restrict Admin Server access to a management subnet with iptables
iptables -A INPUT -p tcp --dport 9000 -s 10.20.30.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 9000 -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
