This vulnerability in Oracle GoldenGate's libraries affects supported versions from 23.4 to 23.26.1. It permits a low privileged attacker who has logon access to the infrastructure where Oracle GoldenGate runs to compromise the software, potentially leading to full control over Oracle GoldenGate. The CVSS 3.1 vector indicates the attack requires local access (AV:L), low complexity (AC:L), low privileges (PR:L), no user interaction (UI:N), and impacts confidentiality, integrity, and availability at a high level (C:H/I:H/A:H). Oracle's July 2026 Critical Patch Update advisory references this vulnerability but does not explicitly confirm patch availability or remediation status for it. Customers are advised to apply security patches promptly as per Oracle's general guidance.

Successful exploitation can lead to complete compromise of Oracle GoldenGate, affecting confidentiality, integrity, and availability of the system. This could allow an attacker with low privileges and local access to take over Oracle GoldenGate operations.

Oracle's July 2026 Critical Patch Update advisory mentions this vulnerability but does not explicitly confirm the availability of a specific patch or fix. Customers should review the advisory at https://www.oracle.com/security-alerts/cpujul2026.html for the latest patch information and apply all relevant security updates promptly. Until a patch is confirmed, restrict local access to Oracle GoldenGate infrastructure to trusted users only. Monitor Oracle's advisories for updates on remediation.