Oracle GoldenGate EUVD-2026-46799

Exploitation requires unauthenticated network access specifically from the physical communication segment attached to the hardware running Oracle GoldenGate - the attacker must be logically adjacent (same LAN, VLAN, or broadcast domain) to the target host, satisfying the AV:A constraint. This is a hard prerequisite that excludes remote internet-facing attackers and substantially narrows the exploitable population to insiders, compromised adjacent hosts, or attackers who have already achieved lateral movement within the data center network. No authentication is required once adjacency is achieved (PR:N), no user interaction is needed (UI:N), and attack complexity is low (AC:L). The impact is strictly bounded to partial availability degradation of the GoldenGate service with no confidentiality or integrity effects, limiting the blast radius even upon successful exploitation.

The CVSS 3.1 base score of 4.3 (Medium) accurately reflects the constrained threat model: AV:A imposes a hard network-adjacency prerequisite, AC:L indicates no special exploitation complexity once adjacency is met, and PR:N confirms no credentials are needed. The impact ceiling is partial DOS only - no data theft or tampering is possible. No EPSS score was provided in the available intelligence, preventing quantitative exploitation-probability assessment. The absence of a CISA KEV listing and any identified public POC suggests this has not seen widespread or active exploitation at time of analysis. Real-world priority is moderate-to-low for most deployments: GoldenGate is typically hosted in controlled data center environments with strict VLAN segmentation, which naturally enforces the AV:A boundary. However, environments where GoldenGate shares a network segment with less-trusted hosts - such as developer workstations, shared management networks, or multi-tenant infrastructure - face meaningfully elevated risk and should prioritize patching.

An attacker who has compromised a host on the same network segment as the GoldenGate server - for example, via a lateral movement step from a developer workstation on a shared management VLAN - sends unauthenticated crafted requests to the Admin Server Executable. The service fails to properly handle the malformed input and enters a degraded availability state, disrupting GoldenGate administrative operations. No public proof-of-concept exploit has been identified, so the precise triggering mechanism remains unconfirmed.