CVE-2026-60398 is a vulnerability in the Oracle GoldenGate Microservices component that permits a low privileged attacker with network access over HTTP to compromise the system. The affected versions are 19.1.0.0.0 through 19.30.0.0, 21.3 through 21.21, and 23.4 through 23.26.1. The vulnerability has a CVSS 3.1 score of 8.8 with high impact on confidentiality, integrity, and availability. Oracle has addressed this vulnerability in its July 2026 Critical Patch Update, which includes security patches for Oracle GoldenGate among many other products. The advisory strongly recommends applying these patches without delay to prevent exploitation.

Successful exploitation of this vulnerability can lead to complete compromise of Oracle GoldenGate, impacting confidentiality, integrity, and availability of the system. An attacker with low privileges and network access via HTTP can leverage this flaw to take over the product, potentially allowing unauthorized access and control over data and operations managed by Oracle GoldenGate.

Oracle has released patches for this vulnerability as part of the July 2026 Critical Patch Update. Users should promptly apply the relevant patches for their affected Oracle GoldenGate versions as documented in the advisory at https://www.oracle.com/security-alerts/cpujul2026.html. No alternative mitigations or temporary fixes are indicated. Staying current with Oracle's security updates is critical to prevent exploitation.