This vulnerability in Oracle GoldenGate's Admin Server Executable component allows an attacker with low privileges and network access over HTTP to read unauthorized subsets of data accessible by Oracle GoldenGate. The affected versions include 19.1.0.0.0 to 19.30.0.0, 21.3 to 21.21, and 23.4 to 23.26.1. The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and limited confidentiality impact without integrity or availability impact. The vendor advisory from Oracle's July 2026 Critical Patch Update mentions this vulnerability but does not explicitly confirm patch availability or remediation level for this specific issue. Oracle strongly recommends applying security patches from the Critical Patch Update to mitigate vulnerabilities.

Successful exploitation results in unauthorized read access to a subset of data accessible by Oracle GoldenGate, potentially exposing sensitive information. The impact is limited to confidentiality with no integrity or availability effects. The vulnerability is exploitable remotely over HTTP by an attacker with low privileges, increasing the risk of unauthorized data disclosure within affected environments.

Oracle's July 2026 Critical Patch Update advisory includes this vulnerability among many others and recommends that customers apply the security patches provided in the update without delay. Although no explicit patch or remediation level is stated for this specific vulnerability in the advisory, applying the Critical Patch Update is the recommended mitigation. Organizations should verify patch availability and installation instructions via the official Oracle advisory at https://www.oracle.com/security-alerts/cpujul2026.html. No alternative mitigations or 'no action required' statements are provided by the vendor.