This vulnerability in Oracle GoldenGate (component: Config Service Executable) affects supported versions from 23.4 to 23.26.2. It permits an unauthenticated attacker with network access over HTTP to compromise the system, potentially resulting in full takeover of Oracle GoldenGate. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) reflects network attack complexity with no privileges or user interaction required, and high impact on confidentiality, integrity, and availability. Oracle's July 2026 Critical Patch Update advisory references this vulnerability among many others but does not provide explicit patch or fix details for these specific versions within the advisory content provided. No known exploits in the wild have been reported as of the advisory date.

Successful exploitation can lead to complete compromise of Oracle GoldenGate, affecting confidentiality, integrity, and availability of the system. This could allow attackers to take over the affected Oracle GoldenGate instance, potentially impacting data replication and integration processes reliant on this software.

Oracle has included this vulnerability in its July 2026 Critical Patch Update advisory. However, explicit patch availability or remediation instructions for Oracle GoldenGate versions 23.4 through 23.26.2 are not detailed in the advisory content provided. Users should consult the official Oracle Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for the latest patch availability and installation instructions. Until patches are applied, users should consider restricting network access to the Oracle GoldenGate Config Service Executable component to trusted sources only. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.