This vulnerability affects Oracle GoldenGate components (Libraries) in specified versions and allows a low privileged attacker who has logon access to the infrastructure to compromise Oracle GoldenGate. The attacker can gain unauthorized read and write access to some Oracle GoldenGate accessible data. The CVSS vector indicates the attack requires local access (AV:L), low complexity (AC:L), low privileges (PR:L), no user interaction (UI:N), unchanged scope (S:U), with limited confidentiality and integrity impacts (C:L/I:L) and no availability impact (A:N). The vendor advisory references a Critical Patch Update released in July 2026 covering many products including Oracle GoldenGate, but the advisory content does not explicitly confirm the availability of a fix for this vulnerability. Patch status is therefore not confirmed and should be verified by consulting the vendor advisory directly.

An attacker with low privileges and logon access to the infrastructure running Oracle GoldenGate can exploit this vulnerability to gain unauthorized read access to some data and unauthorized update, insert, or delete access to some Oracle GoldenGate accessible data. This compromises confidentiality and integrity of the affected data but does not impact availability. The medium CVSS score reflects limited but meaningful impact on data security within the Oracle GoldenGate environment.

Patch status is not yet confirmed — check the Oracle Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle strongly recommends applying security patches promptly and remaining on actively supported versions. Until a patch is confirmed and applied, restrict logon access to the infrastructure running Oracle GoldenGate to trusted users only to reduce risk.