Executive brief
Oracle GoldenGate, a software suite for real-time data integration and replication, contains a vulnerability in its library components. An attacker who already has basic access to the server where the software is running can exploit this flaw to take full control of the GoldenGate environment. This could lead to the unauthorized modification, theft, or deletion of sensitive data being synchronized across the organization's databases.
Technical details
A vulnerability exists in the library components of Oracle GoldenGate (versions 23.4 to 23.26.1). The flaw is classified as easily exploitable by a local attacker with low-level privileges on the underlying infrastructure where GoldenGate is executing. No user interaction is required for exploitation. A successful attack allows for a complete takeover of the Oracle GoldenGate process, impacting all security properties (Confidentiality, Integrity, and Availability). The vulnerability was disclosed as part of the Oracle Critical Patch Update (CPU) for July 2026.
Affected products
- Oracle GoldenGate 23.4-23.26.1
Timeline
- 2026-07-21: disclosed: Published by Oracle and NVD
- 2026-07-21: advisory