Executive brief
Oracle GoldenGate, a software suite for real-time data integration and replication, contains a vulnerability in its library components. A highly privileged attacker with local access to the system could potentially gain unauthorized access to sensitive data or cause the service to crash. Exploitation is considered difficult as it requires interaction from a legitimate user and specific system conditions.
Technical details
A vulnerability exists in the Libraries component of Oracle GoldenGate across multiple versions (19.x, 21.x, and 23.x). The flaw is local in nature, requiring the attacker to already have high-privileged logon access to the underlying infrastructure where GoldenGate is executing. Exploitation is complex (AC:H) and requires human interaction from a person other than the attacker (UI:R). If successful, an attacker can achieve unauthorized access to all GoldenGate data, perform limited data modifications, or cause a complete denial of service by crashing the application. The vulnerability is addressed in the Oracle July 2026 Critical Patch Update.
Affected products
- Oracle GoldenGate 19.1.0.0.0-19.30.0.0, 21.3-21.21, 23.4-23.26.2
Timeline
- 2026-07-21: advisory: Oracle July 2026 Critical Patch Update published
- 2026-07-21: disclosed