Oracle GoldenGate EUVD-2026-46800

Exploitation requires network access over HTTP to the Oracle GoldenGate Microservices management interface and a low-privileged authenticated foothold (CVSS PR:L), meaning the attacker must already possess some valid GoldenGate access or credential rather than being fully anonymous. Affected deployments must run GoldenGate Microservices in versions 19.1.0.0.0-19.30.0.0, 21.3-21.21, or 23.4-23.26.1. No user interaction is required (UI:N) and attack complexity is low (AC:L). The key limiting factors are the PR:L authentication requirement and reachability of the microservices HTTP endpoints - environments that isolate GoldenGate management ports to trusted hosts materially raise the bar.

The signals point to a genuine high priority: CVSS 3.1 8.8 with AV:N/AC:L/PR:L/UI:N and full C:H/I:H/A:H means low-cost, low-privilege network exploitation leading to complete compromise, and Oracle explicitly labels it 'easily exploitable.' The mitigating factor is PR:L - an attacker needs some valid low-privilege access to the GoldenGate microservices, not fully anonymous reach, which narrows the exposure to environments where credentials or a foothold already exist. No EPSS score, KEV listing, SSVC decision, or POC was provided, so exploitation probability cannot be quantified and there is no evidence of active exploitation; the risk is therefore assessed as high-potential-impact but not confirmed-in-the-wild. The Information Disclosure tag is narrower than the description's 'takeover' claim - treat Oracle's takeover language and the C/I/A:H vector as authoritative over the tag.

An attacker who has obtained low-privilege credentials or a limited foothold on the GoldenGate Microservices web interface sends crafted HTTP requests to the management services and escalates to full control of the GoldenGate deployment, reading and altering replicated data flows. Given AV:N/AC:L, no special timing or user interaction is needed once network access exists. No public POC was identified in the provided data.