Vulnerability in Oracle GoldenGate (component: Oracle GoldenGate Microservices). Supported versions that are affected are 19.1.0.0.0-19.30.0.0, 21.3-21.21 and 23.4-23.26.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle GoldenGate. Successful attacks of this vulnerability can result in takeover of Oracle GoldenGate. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

The 21.x version of GoldenGate installed on the remote host is affected by multiple vulnerabilities as referenced in the July 2026 CPU advisory.

  - Vulnerability in the Oracle GoldenGate product of Oracle GoldenGate (component: Service Manager). Easily     exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle     GoldenGate. Successful attacks of this vulnerability can result in takeover of Oracle GoldenGate.
    (CVE-2026-60157)

  - Vulnerability in the Oracle GoldenGate product of Oracle GoldenGate (component: Microservices). Easily     exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle     GoldenGate. Successful attacks of this vulnerability can result in takeover of Oracle GoldenGate.
    (CVE-2026-60398)

  - Vulnerability in the Oracle GoldenGate product of Oracle GoldenGate (component: Admin Server Executable).
    Easily exploitable vulnerability allows low privileged attacker with network access via HTTPS to compromise     Oracle GoldenGate. Successful attacks of this vulnerability can result in takeover of Oracle GoldenGate.
    (CVE-2026-60400)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The 23.x version of GoldenGate installed on the remote host is affected by multiple vulnerabilities as referenced in the July 2026 CPU advisory.

  - Vulnerability in the Oracle GoldenGate product of Oracle GoldenGate (component: Service Manager). Easily     exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle     GoldenGate. Successful attacks of this vulnerability can result in takeover of Oracle GoldenGate.
    (CVE-2026-60157)

  - Vulnerability in the Oracle GoldenGate product of Oracle GoldenGate (component: Microservices). Easily     exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle     GoldenGate. Successful attacks of this vulnerability can result in takeover of Oracle GoldenGate.
    (CVE-2026-60398)

  - Vulnerability in the Oracle GoldenGate product of Oracle GoldenGate (component: Admin Server Executable).
    Easily exploitable vulnerability allows low privileged attacker with network access via HTTPS to compromise     Oracle GoldenGate. Successful attacks of this vulnerability can result in takeover of Oracle GoldenGate.
    (CVE-2026-60400)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The 19.x version of GoldenGate installed on the remote host is affected by multiple vulnerabilities as referenced in the July 2026 CPU advisory.

  - Vulnerability in the Oracle GoldenGate product of Oracle GoldenGate (component: Service Manager). Easily     exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle     GoldenGate. Successful attacks of this vulnerability can result in takeover of Oracle GoldenGate.
    (CVE-2026-60157)

  - Vulnerability in the Oracle GoldenGate product of Oracle GoldenGate (component: Microservices). Easily     exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle     GoldenGate. Successful attacks of this vulnerability can result in takeover of Oracle GoldenGate.
    (CVE-2026-60398)

  - Vulnerability in the Oracle GoldenGate product of Oracle GoldenGate (component: Admin Server Executable).
    Easily exploitable vulnerability allows low privileged attacker with network access via HTTPS to compromise     Oracle GoldenGate. Successful attacks of this vulnerability can result in takeover of Oracle GoldenGate.
    (CVE-2026-60400)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
329213	Oracle GoldenGate 21.x < 21.23.0.0.0 (July 2026 CPU)	Nessus	Misc.	Local	high
329212	Oracle GoldenGate 23.x < 23.26.3.0.0 (July 2026 CPU)	Nessus	Misc.	Local	high
329211	Oracle GoldenGate 19.x < 19.32.0.0.260721 (July 2026 CPU)	Nessus	Misc.	Local	medium

Detections

Analytics

CVE-2026-60398

high

Tenable Plugins

high

high

medium