This vulnerability (CVE-2026-60397) affects the Oracle GoldenGate Admin Server Executable component. It is exploitable by an unauthenticated attacker who has physical access to the communication segment connected to the hardware running Oracle GoldenGate. Successful exploitation results in partial denial of service impacting availability. The affected versions include 19.1.0.0.0 to 19.30.0.0, 21.3 to 21.21, and 23.4 to 23.26.1. The CVSS 3.1 vector indicates low attack complexity, no privileges required, no user interaction, and no impact on confidentiality or integrity, only availability. The vendor advisory references the July 2026 Critical Patch Update, which includes numerous patches but does not explicitly confirm a patch for this specific vulnerability. No known exploits in the wild have been reported.

The vulnerability allows an unauthenticated attacker with physical access to the communication segment of the hardware running Oracle GoldenGate to cause a partial denial of service. This impacts the availability of Oracle GoldenGate but does not affect confidentiality or integrity of data. The CVSS score of 4.3 reflects a medium severity primarily due to availability impact.

Oracle's July 2026 Critical Patch Update advisory includes many security patches across Oracle products. Customers are strongly advised to remain on actively supported versions and apply security patches promptly. However, the advisory does not explicitly confirm a patch for CVE-2026-60397. Therefore, patch status is not yet confirmed—check the Oracle advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Since exploitation requires physical access to the communication segment, limiting physical access and network segmentation may reduce risk.