GoldenGate Management Pack EUVD-2026-106754

Exploitation requires the attacker to have access to the physical/logical communication segment attached to the hardware running Oracle Management Pack for Oracle GoldenGate (CVSS AV:A - adjacent, not remote/internet-routable); it cannot be launched across arbitrary network boundaries. It additionally requires human interaction from a person other than the attacker (UI:R) - a legitimate operator must perform some action for the attack to succeed. No authentication is needed (PR:N) and complexity is low (AC:L). Affected deployments are Oracle Management Pack for Oracle GoldenGate (EM Plugin component) versions 13.4.1.0.1 through 13.5.2.0.6; versions outside this range or the fixed October 2026 CPU release are not exposed. The adjacency and user-interaction requirements are the primary limiting factors reducing realistic exploitability relative to the raw 8.0 score.

This is a genuinely serious flaw (CVSS 3.1 8.0, HIGH) but not an automatic emergency, and the signals point to constrained rather than mass exploitation. The vendor-supplied vector (AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) shows an adjacent-network, low-complexity, unauthenticated attack yielding full confidentiality, integrity and availability loss ('takeover') - but two factors materially cap real-world risk: AV:A means the attacker must already be on the same physical/logical communication segment as the host running Oracle Management Pack for Oracle GoldenGate (not routable across the internet), and UI:R means a human other than the attacker must be induced to act. There is NO EPSS score, NO CISA KEV listing, and NO public exploit referenced in the input, so exploitation status is 'no public exploit identified at time of analysis.' No SSVC decision data was provided. A notable conflict: the only impact Tag supplied is 'Information Disclosure,' yet the CVSS vector and description assert full I:H/A:H takeover - the impact is understated by that tag; treat this as a full-compromise issue, not merely disclosure. Net: a real priority for environments where the GoldenGate management host shares a segment with untrusted or user-operated systems, but the adjacency + user-interaction requirements make it a targeted/insider-adjacent risk rather than a wormable internet-facing one.

An attacker positioned on the same network segment as the Oracle Management Pack for Oracle GoldenGate (EM Plugin) host - for example via a compromised adjacent server or a malicious device on the management VLAN - stages a crafted payload and waits for or lures a legitimate operator into an action that triggers it (UI:R). Because the attack is low-complexity and unauthenticated, successful interaction leads to full takeover of the Management Pack with high confidentiality, integrity, and availability impact. No public proof-of-concept is referenced in the available data.