Goldengate

Full compromise of Oracle GoldenGate 23.4 through 23.26.2 is possible via the Config Service Executable, where an unauthenticated remote attacker sending crafted HTTP traffic can achieve complete takeover with high confidentiality, integrity, and availability impact. Oracle rates this CVSS 3.1 8.1 but explicitly flags it as difficult to exploit (AC:H), and there is no public exploit identified at time of analysis and no CISA KEV listing. Despite Oracle's own tag of 'Information Disclosure,' the described outcome is a broader system takeover, not merely data leakage.

Local privilege abuse in Oracle GoldenGate's Libraries component allows low-privileged OS users on the GoldenGate host to read and modify a subset of GoldenGate-accessible data without proper authorization. Three major version branches are affected - 19.x, 21.x, and 23.x - covering a broad deployment window documented in Oracle's Critical Patch Update for July 2026. No public exploit or active exploitation has been identified at time of analysis; the moderate CVSS 4.4 score correctly reflects the local-only attack vector and constrained data impact.

Oracle GoldenGate Libraries contain a local, high-complexity flaw affecting versions 19.1.0.0.0 through 19.30.0.0, 21.3 through 21.21, and 23.4 through 23.26.2 that allows a high-privileged local attacker - with an additional required victim interaction - to gain complete read access to all GoldenGate-accessible data, partially manipulate data integrity, and cause a complete denial of service via hang or repeatable crash. Tagged as an authentication bypass by intelligence sources, the vulnerability likely allows an already-privileged operator to circumvent an internal GoldenGate security control within the Libraries component, elevating their effective access beyond their authorized scope. No public exploit code or CISA KEV listing has been identified at time of analysis.

Local privilege-based takeover in Oracle GoldenGate 23.4 through 23.26.1 (Libraries component) allows a low-privileged attacker with logon access to the host running GoldenGate to fully compromise the product, with high confidentiality, integrity, and availability impact. Disclosed in Oracle's July 2026 Critical Patch Update (CVSS 3.1 base 7.8), it requires local authenticated access rather than network exploitation. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Privilege escalation to full product takeover in Oracle GoldenGate (Admin Server Executable) lets a low-privileged, network-adjacent attacker seize complete control of the GoldenGate instance over HTTPS. Affected releases span the 19c (19.1.0.0.0-19.30.0.0), 21c (21.3-21.21), and 23ai (23.4-23.26.1) branches, and Oracle rates the impact 8.8 with full confidentiality, integrity, and availability loss. There is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV, but a fix is delivered in the Oracle Critical Patch Update of July 2026.

Denial-of-service conditions in Oracle GoldenGate's Receiver Service Executable allow a low-privileged attacker with HTTP network access to crash or indefinitely hang the replication service. Three major version lines are affected - 19.x, 21.x, and 23.x - covering a broad enterprise installed base. No public exploit code or active exploitation has been identified at time of analysis; risk is moderated by the low-privilege authentication requirement but elevated by low attack complexity and the business-critical role GoldenGate plays in continuous database replication pipelines.

Full product takeover in Oracle GoldenGate Microservices affects releases 19.1.0.0.0-19.30.0.0, 21.3-21.21, and 23.4-23.26.1, where a low-privileged attacker with HTTP network access can compromise the entire GoldenGate instance. Oracle rates this CVSS 3.1 8.8 with high confidentiality, integrity, and availability impact and flags it as easily exploitable, meaning a single authenticated foothold escalates to complete control. No public exploit identified at time of analysis, and it is not listed in CISA KEV.

Partial denial of service in Oracle GoldenGate's Admin Server Executable component is reachable by unauthenticated attackers with access to the adjacent physical communication segment. Three major release trains are affected - 19.1.0.0.0 through 19.30.0.0, 21.3 through 21.21, and 23.4 through 23.26.1 - making this broadly relevant across GoldenGate deployments. No public exploit code and no CISA KEV listing have been identified at time of analysis; exploitation is bounded by the adjacent-network requirement.

Full takeover of Oracle GoldenGate is possible in versions 21.3-21.21 and 23.4-23.26.1 through the Distribution Server executable, where a high-privileged attacker reaching the server over HTTPS can fully compromise confidentiality, integrity, and availability. The flaw carries a CVSS 3.1 base score of 7.2 and requires existing elevated privileges rather than anonymous access, so it is best characterized as a privileged-user-to-full-compromise escalation within the GoldenGate management plane. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Unauthorized read access to Oracle GoldenGate data is possible through a flaw in the Admin Server Executable component, affecting three major release trains spanning versions 19.1.0.0.0 through 23.26.1. A low-privileged network attacker can exploit this Authentication Bypass issue over HTTP without user interaction to read a subset of GoldenGate-accessible data. No public exploit code and no CISA KEV listing have been identified at time of analysis; risk is elevated primarily for deployments exposing the Admin Server to untrusted networks.

Remote unauthenticated information disclosure in Oracle GoldenGate's Admin Server Executable allows network-accessible attackers to read a subset of GoldenGate-accessible data over HTTPS without any credentials. Affected versions span two active branches: 21.3-21.21 and 23.4-23.26.1. No public exploit or CISA KEV listing has been identified at time of analysis; Oracle classifies this as easily exploitable with a CVSS 5.3 Medium score reflecting limited confidentiality impact and no integrity or availability consequence.

Vulnerability in Oracle GoldenGate (component: OGG Core Library). Rated high severity (CVSS 8.8), this vulnerability is low attack complexity. No vendor patch available.

JMSAppender in Log4j 1.2 is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable. Epss exploitation probability 72.2% and no vendor patch available.

axios is vulnerable to Inefficient Regular Expression Complexity. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.

Vulnerability in the Advanced Networking Option component of Oracle Database Server. Rated high severity (CVSS 8.3), this vulnerability is remotely exploitable, no authentication required. Public exploit code available.

A security issue in nginx resolver was identified, which might allow an attacker who is able to forge UDP packets from the DNS server to cause 1-byte memory overwrite, resulting in worker process. Rated high severity (CVSS 7.7), this vulnerability is remotely exploitable, no authentication required. Public exploit code available.

Vulnerability in the Oracle GoldenGate product of Oracle GoldenGate (component: Process Management). Rated critical severity (CVSS 9.6), this vulnerability is no authentication required, low attack complexity. No vendor patch available.

A vulnerability was found in Hibernate-Validator. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

RSA BSAFE Crypto-J versions prior to 6.2.5 are vulnerable to an Information Exposure Through Timing Discrepancy vulnerabilities during DSA key generation. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.

RSA BSAFE Crypto-J versions prior to 6.2.5 are vulnerable to Information Exposure Through Timing Discrepancy vulnerabilities during ECDSA key generation. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.

RSA BSAFE Crypto-J versions prior to 6.2.5 are vulnerable to a Missing Required Cryptographic Step vulnerability. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.

Vulnerability in the Oracle GoldenGate component of Oracle GoldenGate (subcomponent: Manager). Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.

Vulnerability in the Oracle GoldenGate component of Oracle GoldenGate (subcomponent: Monitoring Manager). Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.

Vulnerability in the Oracle GoldenGate component of Oracle GoldenGate (subcomponent: Manager). Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.

Vulnerability in the Oracle GoldenGate component of Oracle GoldenGate. Rated high severity (CVSS 8.6), this vulnerability is remotely exploitable, no authentication required, low attack complexity.

In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events from another application, a specially crafted binary payload can be sent that,. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 94.0%.

Unspecified vulnerability in the Oracle GoldenGate component in Oracle GoldenGate 11.2 and 12.1.2 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors, a. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, low attack complexity. Epss exploitation probability 11.9% and no vendor patch available.

Unspecified vulnerability in the Oracle GoldenGate component in Oracle GoldenGate 11.2 and 12.1.2 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors, a. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 12.4%.

Unspecified vulnerability in the Oracle GoldenGate component in Oracle GoldenGate 11.2 and 12.1.2 allows remote attackers to affect availability via unknown vectors. Rated medium severity (CVSS 5.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.