Oracle GoldenGate EUVD-2026-46563

Exploitation requires network HTTP access to the Oracle GoldenGate Service Manager component and a valid low-privileged account on that service (CVSS PR:L - not unauthenticated). No user interaction and no elevated privileges are needed, and attack complexity is low (AC:L), so any actor already holding minimal credentials or able to reach an exposed Service Manager with such an account can attempt takeover. Limiting factors: the attacker must possess at least a low-privileged login and be able to reach the HTTP management interface, so deployments that isolate Service Manager to restricted admin networks and tightly control account issuance materially reduce exposure. Affected only in Oracle GoldenGate 19.1.0.0.0-19.29.0.0, 21.3-21.21, and 23.4-23.26.1.0.0.

This is a genuine high-priority issue rather than a paper high-CVSS finding: CVSS 3.1 8.8 with AV:N/AC:L/PR:L/UI:N and H/H/H impacts describes a network-reachable, low-complexity attack requiring only a low-privileged account and no user interaction, resulting in complete product takeover. Oracle's own text reinforces this by calling it 'easily exploitable.' However, exploitation is not unauthenticated - PR:L means the attacker needs some valid, low-tier credentials or account on the Service Manager, which bounds the population of attackers to those with existing access or the ability to obtain a low-privileged login. No EPSS score, KEV listing, POC, or SSVC decision data was provided, so real-world exploitation likelihood cannot be quantified from the input; the scoring here rests on CVSS and Oracle's qualitative rating alone. Given GoldenGate's role bridging production databases, a successful compromise has outsized downstream blast radius even though the raw probability of mass exploitation is presently unknown.

An attacker who has obtained low-privileged credentials to a GoldenGate deployment - for example a limited operator account or leaked service login - sends crafted HTTP requests to the Service Manager over the network. Because attack complexity is low and no user interaction is required, they escalate from that limited role to full control of GoldenGate, gaining the ability to read, alter, and disrupt replicated data flows. No public proof-of-concept is identified at time of analysis.