Oracle GoldenGate EUVD-2026-24348

No special configuration is required beyond a default network-accessible Oracle GoldenGate deployment - the CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms unauthenticated exploitation with low complexity and no user interaction over HTTP. The vulnerability is bounded to GoldenGate versions 23.4 through 23.10; systems running versions outside this range are not listed as vulnerable. Exploitation is further limited by the partial confidentiality scope - only a subset of GoldenGate-accessible data is exposed, and integrity and availability remain intact. Organizations that have restricted HTTP access to GoldenGate behind internal network segments or firewall rules to trusted hosts have meaningfully reduced real-world exposure even without patching, since the attacker must have network-layer reachability to the HTTP interface to exploit the flaw.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) paints a straightforward picture: easily reachable over the network, no authentication required, no complexity barrier. These metrics alone would suggest medium urgency. However, the broader intelligence picture significantly moderates that assessment. EPSS sits at just 0.03% (8th percentile), one of the lowest exploitation probability bins, indicating the security research and threat actor community has shown minimal interest in weaponizing this flaw. CISA KEV does not list this CVE, and SSVC independently corroborates exploitation status as none. The technical impact is rated partial, and the confidentiality loss is bounded - only a subset of GoldenGate-accessible data is exposed, not full system access. The automatable=yes SSVC flag is the one signal worth noting, as it means a scanner or script could probe large numbers of GoldenGate instances systematically; however, without evidence of active campaigns, this is a theoretical risk. The overall picture is a low-priority patching item - real but not urgent absent threat intelligence changes.

An unauthenticated attacker with network access to a GoldenGate 23.4-23.10 HTTP endpoint sends a crafted HTTP request that triggers the CWE-200 disclosure in the Libraries component, receiving a subset of GoldenGate-accessible data - potentially including replication metadata, configuration details, or other internally scoped information depending on the deployment context. No public exploit code has been identified at time of analysis, and the low EPSS score suggests this scenario remains largely theoretical rather than actively pursued by threat actors.