The vulnerability in the Oracle Management Pack for Oracle GoldenGate’s EM Plugin allows an unauthenticated attacker who has access to the physical communication segment attached to the hardware to compromise the product. The flaw can result in full takeover, impacting confidentiality, integrity, and availability of the management pack. The weakness stems from improper authorization controls that fail to verify the source of communication at the hardware level.

Oracle Corporation’s Oracle Management Pack for Oracle GoldenGate, particularly versions 13.4.1.0.1 through 13.5.2.0.6. The affected component is the EM Plugin, which is part of the GoldenGate messaging infrastructure. Systems running these versions on hardware with exposed or unprotected communication channels are at risk.

The CVSS v3.1 base score of 8.0 indicates high severity with full confidentiality, integrity, and availability impacts. The attack vector is adjacent network (physical access), requiring low attack complexity but no user interaction beyond a separate dedicated human. Although EPSS is not available, the requirement for physical proximity means the vulnerability may be targeted in environments where an attacker can acquire hardware access. The risk is amplified by the high impact score and the fact that no mitigations are listed in KEV catalogs, implying the flaw is currently unpatched in a significant number of deployments.