Oracle Goldengate Stream Analytics vulnerabilities

11 CVEs affecting Oracle Goldengate Stream Analytics, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-47022, published 2026-07-21.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2018-8088, published 2018-03-20. Critical severity, CVSS 9.8. EPSS: 14.7% chance of exploitation in the next 30 days. org.slf4j.ext.EventData in the slf4j-ext module in QOS.CH SLF4J before 1.8.0-beta2 allows remote attackers to bypass intended access restrictions via crafted data. EventData in the slf4j-ext module…
CVE-2019-0222, published 2019-03-28. High severity, CVSS 7.5. EPSS: 12% chance of exploitation in the next 30 days. In Apache ActiveMQ 5.0.0 - 5.15.8, unmarshalling corrupt MQTT frame can lead to broker Out of Memory exception making it unresponsive.
CVE-2019-14540, published 2019-09-15. Critical severity, CVSS 9.8. EPSS: 10.8% chance of exploitation in the next 30 days. A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10. It is related to com.zaxxer.hikari.HikariConfig.
CVE-2019-14439, published 2019-07-30. High severity, CVSS 7.5. EPSS: 10.8% chance of exploitation in the next 30 days. A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.x before 2.9.9.2. This occurs when Default Typing is enabled (either globally or for a specific property) for an externally…
CVE-2019-0201, published 2019-05-23. Medium severity, CVSS 5.9. EPSS: 9.7% chance of exploitation in the next 30 days. An issue is present in Apache ZooKeeper 1.0.0 to 3.4.13 and 3.5.0-alpha to 3.5.4-beta. ZooKeeper’s getACL() command doesn’t check any permission when retrieves the ACLs of the requested node and…
CVE-2019-20330, published 2020-01-03. Critical severity, CVSS 9.8. EPSS: 8.6% chance of exploitation in the next 30 days. FasterXML jackson-databind 2.x before 2.9.10.2 lacks certain net.sf.ehcache blocking.
CVE-2018-8012, published 2018-05-21. High severity, CVSS 7.5. EPSS: 8.5% chance of exploitation in the next 30 days. No authentication/authorization is enforced when a server attempts to join a quorum in Apache ZooKeeper before 3.4.10, and 3.5.0-alpha through 3.5.3-beta. As a result an arbitrary end point could…
CVE-2019-14379, published 2019-07-29. Critical severity, CVSS 9.8. EPSS: 8.1% chance of exploitation in the next 30 days. SubTypeValidator.java in FasterXML jackson-databind before 2.9.9.2 mishandles default typing when ehcache is used (because of net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup),…
CVE-2019-16335, published 2019-09-15. Critical severity, CVSS 9.8. EPSS: 4.9% chance of exploitation in the next 30 days. A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10. It is related to com.zaxxer.hikari.HikariDataSource. This is a different vulnerability than CVE-2019-14540.
CVE-2019-14893, published 2020-03-02. Critical severity, CVSS 9.8. EPSS: 4.1% chance of exploitation in the next 30 days. A flaw was discovered in FasterXML jackson-databind in all versions before 2.9.10 and 2.10.0, where it would permit polymorphic deserialization of malicious objects using the xalan JNDI gadget when…

Latest

CVE-2026-47022, published 2026-07-21. Low severity, CVSS 3.3. EPSS: 0.1% chance of exploitation in the next 30 days. Vulnerability in the GoldenGate Stream Analytics product of Oracle GoldenGate (component: Security). The supported version that is affected is 26.1.0.0.0. Easily exploitable vulnerability allows…