CVE-2026-60400 is a vulnerability in the Admin Server Executable component of Oracle GoldenGate that allows a low privileged attacker with network access over HTTPS to compromise the system. The vulnerability affects multiple versions spanning from 19.1.0.0.0 to 19.30.0.0, 21.3 to 21.21, and 23.4 to 23.26.1. The CVSS 3.1 score of 8.8 reflects high severity with impacts on confidentiality, integrity, and availability. The vulnerability is categorized under CWE-284 (Improper Access Control). Oracle's July 2026 Critical Patch Update advisory references this vulnerability among many others but does not explicitly state the patch status for this specific issue. No known exploits in the wild have been reported as of the advisory date. Oracle recommends applying security patches without delay and remaining on actively supported versions.

Successful exploitation of this vulnerability can lead to complete compromise of Oracle GoldenGate, impacting confidentiality, integrity, and availability of the system. An attacker with low privileges and network access via HTTPS could take over the Oracle GoldenGate environment, potentially leading to unauthorized data access, modification, or disruption of service.

Oracle has included this vulnerability in its July 2026 Critical Patch Update advisory. While the advisory lists affected products and versions, it does not explicitly confirm the availability of a patch for CVE-2026-60400 at this time. Customers should monitor the Oracle Critical Patch Update advisory for patch release information and apply patches promptly once available. Oracle strongly recommends remaining on actively supported versions and applying security patches without delay to mitigate this and other vulnerabilities.