This vulnerability in Oracle GoldenGate Admin Server Executable permits an unauthenticated attacker with network access over HTTPS to read a subset of accessible data without authorization. The affected versions are 21.3 through 21.21 and 23.4 through 23.26.1. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) indicates network attack vector, low attack complexity, no privileges or user interaction required, and only confidentiality impact. Oracle's July 2026 Critical Patch Update advisory lists many patched products but does not explicitly state a patch for this specific vulnerability or Oracle GoldenGate versions affected. The advisory emphasizes applying patches promptly but does not provide direct remediation details for this issue.

Successful exploitation allows unauthorized read access to a subset of Oracle GoldenGate data, impacting confidentiality. There is no impact on integrity or availability. The vulnerability is exploitable remotely without authentication, increasing risk. However, no known exploits in the wild have been reported as of the advisory date.

Patch status is not yet confirmed — check the Oracle Critical Patch Update July 2026 advisory and subsequent updates for current remediation guidance. Oracle strongly recommends applying security patches promptly when available. Until a patch is confirmed, restrict network access to Oracle GoldenGate Admin Server interfaces and monitor for unusual access attempts.