« Volver al listado

CVE-2026-60398

Estado: AnalizadaAlta (8.8)—

Vulnerability in Oracle GoldenGate (component: Oracle GoldenGate Microservices). Supported versions that are affected are 19.1.0.0.0-19.30.0.0, 21.3-21.21 and 23.4-23.26.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle GoldenGate. Successful attacks of this vulnerability can result in takeover of Oracle GoldenGate. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

Vulnerabilidad de autenticación/autorización (CWE-306) en servicio remoto GoldenGate requiriendo solo privilegios bajos y acceso HTTP de red (PR:L, AV:N, AC:L) permite takeover del sistema mediante T1210. Impactos: abuso de credenciales/cuentas (T1078) como primario y ejecución de código (T1059) y m

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Privileged Account ManagementNetwork SegmentationDisable or Remove Feature or ProgramApplication Developer GuidanceActive Directory ConfigurationVulnerability Scanning

Tecnologías afectadas (1)

Oracle — Goldengate

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-60398",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-60398",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-07-24T16:28:45.634816Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "secalert_us@oracle.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 8.8,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "secalert_us@oracle.com",
      "affectedData": [
        {
          "vendor": "Oracle Corporation",
          "product": "Oracle GoldenGate",
          "versions": [
            {
              "status": "affected",
              "version": "19.1.0.0.0",
              "versionType": "custom",
              "lessThanOrEqual": "19.30.0.0"
            },
            {
              "status": "affected",
              "version": "21.3",
              "versionType": "custom",
              "lessThanOrEqual": "21.21"
            },
            {
              "status": "affected",
              "version": "23.4",
              "versionType": "custom",
              "lessThanOrEqual": "23.26.1"
            }
          ]
        }
      ]
    }
  ],
  "published": "2026-07-21T22:17:42.277",
  "references": [
    {
      "url": "https://www.oracle.com/security-alerts/cpujul2026.html",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "secalert_us@oracle.com"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "description": [
        {
          "lang": "en",
          "value": "CWE-306"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Vulnerability in Oracle GoldenGate (component: Oracle GoldenGate Microservices).  Supported versions that are affected are 19.1.0.0.0-19.30.0.0, 21.3-21.21 and  23.4-23.26.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle GoldenGate.  Successful attacks of this vulnerability can result in takeover of Oracle GoldenGate. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)."
    }
  ],
  "lastModified": "2026-08-03T19:02:32.783",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:oracle:goldengate:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C98FDCF4-EF54-4F31-8ADB-BE25F3EC6ACF",
              "versionEndIncluding": "19.30.0.0",
              "versionStartIncluding": "19.1.0.0.0"
            },
            {
              "criteria": "cpe:2.3:a:oracle:goldengate:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7B653233-56BD-42C1-9D97-0742A145AC27",
              "versionEndIncluding": "21.21.0.0.0",
              "versionStartIncluding": "21.3.0"
            },
            {
              "criteria": "cpe:2.3:a:oracle:goldengate:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "05103BC5-F6D9-4572-B0E8-51F372B6B0B5",
              "versionEndIncluding": "23.26.1.0.0",
              "versionStartIncluding": "23.4"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "secalert_us@oracle.com"
}