This vulnerability in Oracle GoldenGate's Distribution Server executable affects supported versions 21.3-21.21 and 23.4-23.26.1. It allows a high privileged attacker with network access over HTTPS to compromise the system, potentially leading to full takeover. The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) indicates network attack vector, low attack complexity, required high privileges, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability. Oracle's July 2026 Critical Patch Update advisory mentions multiple security patches but does not explicitly confirm a fix for this specific vulnerability or provide patch details for these versions. Customers are strongly advised to apply Oracle's security patches promptly as per the advisory.

Successful exploitation can lead to complete compromise of Oracle GoldenGate, impacting confidentiality, integrity, and availability of the system. This could allow an attacker with high privileges and network access via HTTPS to take over the affected Oracle GoldenGate instance.

Oracle's July 2026 Critical Patch Update advisory recommends applying security patches without delay. However, the advisory does not explicitly confirm patch availability or remediation status for this vulnerability in the affected versions. Customers should monitor Oracle's official security advisories and apply any relevant patches as soon as they become available. Until patches are applied, restrict network access to Oracle GoldenGate instances to trusted users with high privileges only.