The vulnerability resides in the Oracle GoldenGate Admin Server Executable. A low‑privileged attacker with network access to the HTTPS interface can exploit the flaw, achieving full takeover of Oracle GoldenGate. Successful exploitation results in complete compromise of confidentiality, integrity, and availability of the system, as reflected by a CVSS 3.1 base score of 8.8. The description explicitly notes that the flaw is easily exploitable and that it allows a low‑privileged attacker to compromise the application.

Oracle Corporation’s Oracle GoldenGate is affected in the following versions: 19.1.0.0.0 through 19.32.0.0, 21.3 through 21.23, and 23.4 through 23.26.3.0.0.

Based on the CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and the EPSS score of <1%, the likelihood of exploitation is very low. The low exploitation complexity and the requirement of only low privileges suggest that the attack path is relatively simple. The vulnerability is not currently listed in the CISA KEV catalog, but its high severity suggests that it could become a target for malicious actors.