This vulnerability in Oracle GoldenGate's libraries allows a high privileged attacker with infrastructure logon to compromise Oracle GoldenGate. Exploitation requires human interaction from a third party and is considered difficult. Impact includes unauthorized access to critical or all accessible data, unauthorized update, insert, or delete operations on some data, and the ability to cause a hang or repeated crash resulting in denial of service. The CVSS vector indicates local attack vector, high attack complexity, high privileges required, user interaction required, unchanged scope, high confidentiality impact, low integrity impact, and high availability impact. Affected versions explicitly include 19.1.0.0.0 through 19.30.0.0, 21.3 through 21.21, and 23.4 through 23.26.2. The vendor advisory from Oracle (July 2026 Critical Patch Update) lists patches for Oracle GoldenGate but does not explicitly confirm patch availability or remediation status for this specific CVE in the provided excerpt.

Successful exploitation can result in unauthorized access to critical or all Oracle GoldenGate accessible data, unauthorized modification (update, insert, delete) of some data, and denial of service by causing Oracle GoldenGate to hang or crash repeatedly. The vulnerability impacts confidentiality (high), integrity (low), and availability (high) of the affected system.

Patch status is not yet confirmed — check the Oracle July 2026 Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle strongly recommends applying security patches without delay and remaining on actively-supported versions. Since exploitation requires high privileges and human interaction, limiting access to the infrastructure and educating users may reduce risk but are not substitutes for patching.