Description
Vulnerability in Oracle GoldenGate (component: Admin Client Executable). Supported versions that are affected are 23.4-23.26.2.0.0. Difficult to exploit vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle GoldenGate. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle GoldenGate accessible data. CVSS 3.1 Base Score 4.4 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N).
Published: 2026-10-20
Score: 4.4 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Unauthorized data access
Action: Apply patch
AI Analysis

Impact

This vulnerability exists in the Admin Client executable of Oracle GoldenGate. An attacker with high privileges who can reach the HTTP interface can exploit a flaw that allows them to gain unauthorized access to data. The impact is limited to confidentiality—critical data can be accessed or all data made available to the attacker.

Affected Systems

Oracle GoldenGate versions from 23.4 through 23.26.2.0.0 are affected. The vulnerability is tied specifically to the Admin Client component exposed over HTTP.

Risk and Exploitability

The CVSS 3.1 base score is 4.4, indicating a moderate confidentiality impact with the attacker required to have high privileges and network access via HTTP. EPSS data is unavailable and the vulnerability is not listed in CISA KEV. A high privileged attacker who can reach the affected interface is capable of compromising the system, leading to unauthorized data disclosure.

Generated by OpenCVE AI on October 21, 2026 at 10:26 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade to a patched version of Oracle GoldenGate that resolves the Admin Client vulnerability as indicated in the Oracle security alert
  • Restrict HTTP access to the Admin Client to trusted IP addresses or networks using firewall or network ACLs
  • Monitor audit logs for anomalous authentication or data access attempts involving the Admin Client interface

Generated by OpenCVE AI on October 21, 2026 at 10:26 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 26 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 21 Oct 2026 10:45:00 +0000

Type Values Removed Values Added
Title High Privileged Data Access via Admin Client in Oracle GoldenGate
Weaknesses CWE-284

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Vulnerability in Oracle GoldenGate (component: Admin Client Executable). Supported versions that are affected are 23.4-23.26.2.0.0. Difficult to exploit vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle GoldenGate. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle GoldenGate accessible data. CVSS 3.1 Base Score 4.4 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N).
First Time appeared Oracle
Oracle goldengate
CPEs cpe:2.3:a:oracle:goldengate:*:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle goldengate
References
Metrics cvssV3_1

{'score': 4.4, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N'}

Subscriptions

Oracle Goldengate
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-10-26T20:02:15.022Z

Reserved: 2026-09-14T22:10:16.642Z

Link: CVE-2026-91530

cve-icon Vulnrichment

Updated: 2026-10-26T20:02:07.129Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-20T22:20:56.837

Modified: 2026-10-26T21:20:39.080

Link: CVE-2026-91530

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-22T15:30:08Z

Weaknesses