Threat Intelligence Database

CVE-2026-61106 is a high-severity vulnerability in Oracle GoldenGate's Config Service Executable component affecting versions 23.4 through 23.26.2. It allows an unauthenticated attacker with network access via HTTP to potentially compromise the product, leading to full takeover. The vulnerability is difficult to exploit and has a CVSS 3.1 base score of 8.1, indicating high impact on confidentiality, integrity, and availability. Oracle has published a Critical Patch Update advisory in July 2026 addressing multiple vulnerabilities, but no explicit patch or remediation details for this specific issue are provided in the advisory. Users are strongly recommended to apply Oracle's security patches promptly. No known exploits in the wild have been reported yet.

CVE-2026-61084 is a vulnerability in Oracle GoldenGate libraries affecting versions 19.1.0.0.0 through 19.30.0.0, 21.3 through 21.21, and 23.4 through 23.26.2. It allows a low privileged attacker with logon access to the infrastructure running Oracle GoldenGate to compromise the product. Successful exploitation can lead to unauthorized read and modification (update, insert, delete) of some data accessible by Oracle GoldenGate. The CVSS 3.1 base score is 4.4, indicating a medium severity vulnerability with limited confidentiality and integrity impact and no availability impact. Oracle has published a Critical Patch Update advisory that includes patches for multiple vulnerabilities but does not explicitly confirm a patch for this specific issue in the provided content.

Vulnerability in Oracle GoldenGate (component: Admin Server Executable). Supported versions that are affected are 19.1.0.0.0-19.30.0.0, 21.3-21.21 and 23.4-23.26.1. Easily exploitable vulnerability allows unauthenticated attacker with access to the physical communication segment attached to the hardware where the Oracle GoldenGate executes to compromise Oracle GoldenGate. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle GoldenGate. CVSS 3.1 Base Score 4.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).

Vulnerability in Oracle GoldenGate (component: Distribution Server executable). Supported versions that are affected are 21.3-21.21 and 23.4-23.26.1. Easily exploitable vulnerability allows high privileged attacker with network access via HTTPS to compromise Oracle GoldenGate. Successful attacks of this vulnerability can result in takeover of Oracle GoldenGate. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).

CVE-2026-60157 is a high-severity vulnerability in Oracle GoldenGate's Service Manager component affecting multiple versions. It allows a low privileged attacker with network access via HTTP to potentially take over the Oracle GoldenGate system. The vulnerability impacts confidentiality, integrity, and availability with a CVSS 3.1 base score of 8.8. Oracle has included this vulnerability in its July 2026 Critical Patch Update advisory, which provides patches for affected versions. Users are strongly advised to apply the relevant patches promptly to mitigate the risk.