Oracle Goldengate vulnerabilities

34 CVEs affecting Oracle Goldengate, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-61106, published 2026-07-21.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2017-5645, published 2017-04-17. Critical severity, CVSS 9.8. EPSS: 89.8% chance of exploitation in the next 30 days. In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events from another application, a specially crafted binary payload can be sent that,…
CVE-2021-4104, published 2021-12-14. High severity, CVSS 7.5. EPSS: 80.6% chance of exploitation in the next 30 days. JMSAppender in Log4j 1.2 is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration. The attacker can provide TopicBindingName and…
CVE-2021-23017, published 2021-06-01. High severity, CVSS 7.7. EPSS: 53.5% chance of exploitation in the next 30 days. A security issue in nginx resolver was identified, which might allow an attacker who is able to forge UDP packets from the DNS server to cause 1-byte memory overwrite, resulting in worker process…
CVE-2018-1311, published 2019-12-18. High severity, CVSS 8.1. EPSS: 9.5% chance of exploitation in the next 30 days. The Apache Xerces-C 3.0.0 to 3.2.3 XML parser contains a use-after-free error triggered during the scanning of external DTDs. This flaw has not been addressed in the maintained version of the library…
CVE-2021-3749, published 2021-08-31. High severity, CVSS 7.5. EPSS: 8.5% chance of exploitation in the next 30 days. axios is vulnerable to Inefficient Regular Expression Complexity
CVE-2016-0451, published 2016-01-21. High severity, CVSS 10.0. EPSS: 6.8% chance of exploitation in the next 30 days. Unspecified vulnerability in the Oracle GoldenGate component in Oracle GoldenGate 11.2 and 12.1.2 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors, a…
CVE-2016-0452, published 2016-01-21. High severity, CVSS 10.0. EPSS: 5.9% chance of exploitation in the next 30 days. Unspecified vulnerability in the Oracle GoldenGate component in Oracle GoldenGate 11.2 and 12.1.2 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors, a…
CVE-2018-2913, published 2018-10-17. Critical severity, CVSS 10.0. EPSS: 4.2% chance of exploitation in the next 30 days. Vulnerability in the Oracle GoldenGate component of Oracle GoldenGate (subcomponent: Monitoring Manager). Supported versions that are affected are 12.1.2.1.0, 12.2.0.2.0 and 12.3.0.1.0. Easily…
CVE-2019-3740, published 2019-09-18. Medium severity, CVSS 6.5. EPSS: 3.9% chance of exploitation in the next 30 days. RSA BSAFE Crypto-J versions prior to 6.2.5 are vulnerable to an Information Exposure Through Timing Discrepancy vulnerabilities during DSA key generation. A malicious remote attacker could…
CVE-2018-2914, published 2018-10-17. High severity, CVSS 7.5. EPSS: 3.9% chance of exploitation in the next 30 days. Vulnerability in the Oracle GoldenGate component of Oracle GoldenGate (subcomponent: Manager). Supported versions that are affected are 12.1.2.1.0, 12.2.0.2.0 and 12.3.0.1.0. Easily exploitable…

Latest

CVE-2026-61106, published 2026-07-21. High severity, CVSS 8.1. EPSS: 0.4% chance of exploitation in the next 30 days. Vulnerability in Oracle GoldenGate (component: Config Service Executable). Supported versions that are affected are 23.4-23.26.2. Difficult to exploit vulnerability allows unauthenticated attacker…
CVE-2026-61084, published 2026-07-21. Medium severity, CVSS 4.4. EPSS: 0.1% chance of exploitation in the next 30 days. Vulnerability in Oracle GoldenGate (component: Libraries). Supported versions that are affected are 19.1.0.0.0-19.30.0.0, 21.3-21.21 and 23.4-23.26.2. Easily exploitable vulnerability allows low…
CVE-2026-61079, published 2026-07-21. Medium severity, CVSS 5.8. EPSS: 0.1% chance of exploitation in the next 30 days. Vulnerability in Oracle GoldenGate (component: Libraries). Supported versions that are affected are 19.1.0.0.0-19.30.0.0, 21.3-21.21 and 23.4-23.26.2. Difficult to exploit vulnerability allows high…
CVE-2026-60570, published 2026-07-21. High severity, CVSS 7.8. EPSS: 0.2% chance of exploitation in the next 30 days. Vulnerability in Oracle GoldenGate (component: Libraries). Supported versions that are affected are 23.4-23.26.1. Easily exploitable vulnerability allows low privileged attacker with logon to the…
CVE-2026-60400, published 2026-07-21. High severity, CVSS 8.8. EPSS: 0.4% chance of exploitation in the next 30 days. Vulnerability in Oracle GoldenGate (component: Admin Server Executable). Supported versions that are affected are 19.1.0.0.0-19.30.0.0, 21.3-21.21 and 23.4-23.26.1. Easily exploitable vulnerability…
CVE-2026-60399, published 2026-07-21. Medium severity, CVSS 6.5. EPSS: 0.4% chance of exploitation in the next 30 days. Vulnerability in Oracle GoldenGate (component: Receiver Service Executable). Supported versions that are affected are 19.1.0.0.0-19.30.0.0, 21.3-21.21 and 23.4-23.26.1. Easily exploitable…
CVE-2026-60398, published 2026-07-21. High severity, CVSS 8.8. EPSS: 0.4% chance of exploitation in the next 30 days. Vulnerability in Oracle GoldenGate (component: Oracle GoldenGate Microservices). Supported versions that are affected are 19.1.0.0.0-19.30.0.0, 21.3-21.21 and 23.4-23.26.1. Easily exploitable…
CVE-2026-60397, published 2026-07-21. Medium severity, CVSS 4.3. EPSS: 0.3% chance of exploitation in the next 30 days. Vulnerability in Oracle GoldenGate (component: Admin Server Executable). Supported versions that are affected are 19.1.0.0.0-19.30.0.0, 21.3-21.21 and 23.4-23.26.1. Easily exploitable vulnerability…
CVE-2026-60396, published 2026-07-21. High severity, CVSS 7.2. EPSS: 0.5% chance of exploitation in the next 30 days. Vulnerability in Oracle GoldenGate (component: Distribution Server executable). Supported versions that are affected are 21.3-21.21 and 23.4-23.26.1. Easily exploitable vulnerability allows high…
CVE-2026-60395, published 2026-07-21. Medium severity, CVSS 4.3. EPSS: 0.3% chance of exploitation in the next 30 days. Vulnerability in Oracle GoldenGate (component: Admin Server Executable). Supported versions that are affected are 19.1.0.0.0-19.30.0.0, 21.3-21.21 and 23.4-23.26.1. Easily exploitable…