Description
Vulnerability in Oracle GoldenGate (component: Vendor Access Module). Supported versions that are affected are 19.1.0.0.0-19.32.0.0, 21.3-21.23 and 23.4-23.26.3.0.0. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle GoldenGate executes to compromise Oracle GoldenGate. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle GoldenGate accessible data. CVSS 3.1 Base Score 5.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).
Published: 2026-10-20
Score: 5.5 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Confidentiality loss
Action: Apply Patch
AI Analysis

Impact

Vulnerability in Oracle GoldenGate’s Vendor Access Module allows a user who can log on to the host where GoldenGate runs to compromise the service. By leveraging local privileges, the attacker can read critical data or gain complete access to all data that GoldenGate can read. The CVSS 3.1 base score of 5.5 reflects a moderate severity with a high confidentiality impact while impact on integrity and availability is negligible.

Affected Systems

Oracle GoldenGate versions 19.1.0.0.0 through 19.32.0.0, 21.3 up to 21.23, and 23.4 up to 23.26.3.0.0 are affected.

Risk and Exploitability

The vulnerability requires local access and low privileges, meaning it can be exploited by anyone who can log on to the infrastructure hosting GoldenGate. While the EPSS score is < 1% and the issue is not listed in CISA KEV, the CVSS score of 5.5, combined with the local attack surface, indicates a moderate but tangible risk of unauthorized data exposure.

Generated by OpenCVE AI on October 27, 2026 at 09:58 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update Oracle GoldenGate to a version that includes the vendor‑released fix as detailed in the October 2026 security advisory
  • Limit local access to the servers running GoldenGate to only trusted administrators and remove any unnecessary user accounts
  • If the Vendor Access Module is not required for your deployment, disable or uninstall it to reduce the attack surface

Generated by OpenCVE AI on October 27, 2026 at 09:58 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 27 Oct 2026 10:15:00 +0000

Type Values Removed Values Added
Title Local Privilege Escalation in Oracle GoldenGate Vendor Access Module Leading to Data Exposure

Tue, 27 Oct 2026 04:30:00 +0000

Type Values Removed Values Added
Title Oracle GoldenGate Vendor Access Module Local Privilege Escalation Risk
Weaknesses CWE-200
CWE-284

Mon, 26 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-269
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 21 Oct 2026 10:45:00 +0000

Type Values Removed Values Added
Title Oracle GoldenGate Vendor Access Module Local Privilege Escalation Risk
Weaknesses CWE-200
CWE-284

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Vulnerability in Oracle GoldenGate (component: Vendor Access Module). Supported versions that are affected are 19.1.0.0.0-19.32.0.0, 21.3-21.23 and 23.4-23.26.3.0.0. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle GoldenGate executes to compromise Oracle GoldenGate. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle GoldenGate accessible data. CVSS 3.1 Base Score 5.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).
First Time appeared Oracle
Oracle goldengate
CPEs cpe:2.3:a:oracle:goldengate:*:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle goldengate
References
Metrics cvssV3_1

{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'}

Subscriptions

Oracle Goldengate
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-10-26T20:14:09.676Z

Reserved: 2026-09-14T22:10:16.643Z

Link: CVE-2026-91547

cve-icon Vulnrichment

Updated: 2026-10-26T20:14:04.259Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-20T22:20:58.083

Modified: 2026-10-26T21:20:43.477

Link: CVE-2026-91547

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-27T10:00:15Z

Weaknesses
  • CWE-269

    Improper Privilege Management