A local attacker with low privileges who can log onto the infrastructure where Oracle GoldenGate runs can exploit an vulnerability in the Vendor Access Module. The flaw allows the attacker to compromise GoldenGate and access critical data, resulting in a confidentiality breach. The weakness is reflected in a CVSS 3.1 score of 5.5, indicating moderate severity with a high impact on confidentiality but no impact on integrity or availability.

Oracle GoldenGate versions 21.3 through 21.23 are affected. Users of these releases should verify their installed version against the identified range.

The CVSS score of 5.5 shows a moderate risk, and the EPSS score is currently unavailable, suggesting limited public exploitation data. As the issue is not listed in CISA’s KEV catalog, immediate large‑scale exploitation is unlikely. The attack vector is local with low effort and requires only an active logon to the underlying system. The vulnerability primarily threatens data confidentiality and can be mitigated through patching or access restrictions.