A high-severity vulnerability in Oracle GoldenGate Microservices allows low-privileged attackers to gain unauthorized control over the application.

This vulnerability affects the Microservices component of Oracle GoldenGate, permitting a low-privileged, authenticated attacker to compromise the system through HTTP-based network access.

Exploitation of this vulnerability could lead to the compromise of data synchronization processes, potentially allowing an attacker to manipulate or exfiltrate sensitive data in transit. With a CVSS score of 8.8, this flaw represents a significant risk to the integrity of business data pipelines and overall system availability.

Immediate Action: Update Oracle GoldenGate instances to the versions identified as secure in the July 2026 Oracle Critical Patch Update.

Proactive Monitoring: Monitor GoldenGate Microservices logs for signs of unauthorized access or unusual administrative activity.

Compensating Controls: Restrict network access to the GoldenGate management interfaces to trusted IP ranges only to reduce the attack surface.

Public Exploit Available: No

The broad range of affected versions requires immediate attention from system administrators. It is critical to apply the necessary patches to maintain the security and integrity of your data integration infrastructure.