CVE-2026-60399 Overview
CVE-2026-60399 is a denial-of-service vulnerability in the Receiver Service Executable component of Oracle GoldenGate. A low-privileged attacker with network access over HTTP can trigger a hang or repeatable crash, resulting in complete availability loss of the GoldenGate service. The flaw affects Oracle GoldenGate versions 19.1.0.0.0-19.30.0.0, 21.3-21.21, and 23.4-23.26.1. Oracle disclosed the issue in the July 2026 Critical Patch Update. Confidentiality and integrity are not impacted, but the availability impact is high. Exploitation does not require user interaction.
Critical Impact
Authenticated network attackers can reliably crash the Oracle GoldenGate Receiver Service, disrupting data replication pipelines that depend on continuous availability.
Affected Products
- Oracle GoldenGate 19.1.0.0.0 through 19.30.0.0
- Oracle GoldenGate 21.3 through 21.21
- Oracle GoldenGate 23.4 through 23.26.1
Discovery Timeline
- 2026-07-21 - CVE-2026-60399 published to NVD
- 2026-07-21 - Last updated in NVD database
- Vendor advisory: Oracle Security Alert July 2026
Technical Details for CVE-2026-60399
Vulnerability Analysis
The vulnerability resides in the Receiver Service Executable, a network-facing component of Oracle GoldenGate that accepts HTTP requests as part of the replication workflow. An authenticated attacker with low privileges can send crafted HTTP traffic that causes the service to hang or crash repeatedly. The result is a complete denial of service against the affected GoldenGate instance.
GoldenGate is deployed to move transactional data between heterogeneous databases in near real time. A crash of the Receiver Service interrupts trail file delivery and downstream replication, which can cascade into stale data for analytics, reporting, and disaster recovery systems that depend on the feed.
Oracle rated the flaw with a CVSS 3.1 base score reflecting availability-only impact. Public exploit code is not currently available, and the EPSS probability score sits at approximately 0.289%.
Root Cause
Oracle has not published detailed root cause information. Based on the advisory metadata, the defect lies in how the Receiver Service Executable parses or processes HTTP input, allowing malformed or unexpected requests to terminate service operation. Refer to the Oracle Security Alert July 2026 for vendor-supplied details.
Attack Vector
An attacker requires network reachability to the Receiver Service HTTP endpoint and a low-privilege authenticated session. The attack complexity is low and requires no user interaction. Once conditions are met, the attacker submits HTTP requests that force the service into a hang state or induce a repeatable crash, denying access to legitimate replication clients until the service is restarted or patched.
No verified exploitation code has been published. See the vendor advisory for technical guidance.
Detection Methods for CVE-2026-60399
Indicators of Compromise
- Repeated unexpected termination or restart events of the Oracle GoldenGate Receiver Service process
- Bursts of HTTP requests to the Receiver Service endpoint originating from low-privilege or unusual accounts
- Trail file delivery gaps and replication lag alarms that coincide with service restarts
Detection Strategies
- Alert on GoldenGate service crash and restart events in host and application logs
- Correlate HTTP request patterns against the Receiver Service with authenticated user sessions to identify abuse of low-privilege accounts
- Baseline normal replication throughput and flag sustained deviations that align with service unavailability
Monitoring Recommendations
- Enable verbose logging on the GoldenGate Receiver Service and forward logs to a centralized analytics platform
- Monitor process availability with health checks that page on service hang or exit conditions
- Track authentication events for GoldenGate accounts and investigate accounts issuing anomalous HTTP volumes
How to Mitigate CVE-2026-60399
Immediate Actions Required
- Apply the July 2026 Oracle Critical Patch Update to all affected GoldenGate instances
- Inventory GoldenGate deployments and confirm version levels against the affected version ranges
- Restrict network exposure of the Receiver Service HTTP endpoint to trusted replication hosts only
- Rotate and audit credentials of low-privilege GoldenGate accounts that can reach the Receiver Service
Patch Information
Oracle addressed CVE-2026-60399 in the July 2026 Critical Patch Update. Refer to Oracle Security Alert July 2026 for patch downloads and version-specific instructions. Administrators running 19.1.0.0.0-19.30.0.0, 21.3-21.21, or 23.4-23.26.1 must upgrade to the fixed release identified in the advisory.
Workarounds
- Place the Receiver Service behind a network access control list that allows only known replication peers
- Enforce mutual authentication and TLS on the HTTP interface to reduce the population of accounts able to reach the endpoint
- Implement rate limiting or a reverse proxy in front of the Receiver Service to blunt abusive request patterns until patches are deployed
# Example iptables rule restricting Receiver Service HTTP access to trusted peers
iptables -A INPUT -p tcp --dport 9010 -s 10.10.20.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 9010 -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
