{"id":"CVE-2026-101601","kind":"vulnerability","aliases":["CVE-2026-101601"],"related":[],"title":"Oracle GoldenGate: Vendor Access Module flaw exposes data to local low-privilege users","description":"Vulnerability in Oracle GoldenGate (component: Vendor Access Module).  Supported versions that are affected are 21.3-21.23. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle GoldenGate executes to compromise Oracle GoldenGate.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle GoldenGate accessible data. CVSS 3.1 Base Score 5.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).","summary":"Oracle GoldenGate versions 21.3 through 21.23 have a flaw in the Vendor Access Module. An attacker with a low-privilege logon on the host running GoldenGate can read critical data the product can reach.","severity":"medium","cvss":5.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["database-replication","oracle-goldengate","other","self-hosted"],"not_affected_if":["no-local-logon","unaffected-version"],"how_to_check":"- Check the installed GoldenGate version against the affected range 21.3 to 21.23 in the Oracle GoldenGate home directory\n- Confirm the Vendor Access Module is present on the host: unknown","fix":"- Move Oracle GoldenGate to a release outside 21.3 to 21.23 as listed in Oracle's Critical Patch Update advisory: unknown\n- Restrict local logon to hosts running GoldenGate to trusted accounts","status":"open","published_at":"2026-10-20T22:18:13+00:00","first_seen_at":"2026-10-23T21:57:22+00:00","triaged_at":"2026-10-25T04:12:20+00:00","updated_at":"2026-10-25T04:12:20+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-10-25T04:12:20Z","model":"claude-haiku-5-5","output":{"fix":"- Move Oracle GoldenGate to a release outside 21.3 to 21.23 as listed in Oracle's Critical Patch Update advisory: unknown\n- Restrict local logon to hosts running GoldenGate to trusted accounts","reach":"local","title":"Oracle GoldenGate: Vendor Access Module flaw exposes data to local low-privilege users","impact":"medium","summary":"Oracle GoldenGate versions 21.3 through 21.23 have a flaw in the Vendor Access Module. An attacker with a low-privilege logon on the host running GoldenGate can read critical data the product can reach.","category":"other","nicknames":[],"who_cares":["oracle-goldengate","self-hosted","database-replication"],"confidence":0.6,"needs_auth":"yes","worst_case":"Low-privilege local user reads critical data GoldenGate can access","analyst_note":"Check Oracle's April 2026 Critical Patch Update advisory for the fixed version and whether the Vendor Access Module is on by default.","how_to_check":"- Check the installed GoldenGate version against the affected range 21.3 to 21.23 in the Oracle GoldenGate home directory\n- Confirm the Vendor Access Module is present on the host: unknown","needs_analyst":true,"not_affected_if":["no-local-logon","unaffected-version"],"who_is_affected":"Hosts where Oracle GoldenGate 21.3 through 21.23 runs and where people without admin rights can log on. The sources do not say which deployment setups expose the Vendor Access Module by default, so teams should assume their installs are in scope until checked.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000644,"input_tokens":3450,"output_tokens":599,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-101601':17A,20A '-2026':16A,19A '-21.23':81C '/av':135C '21.23':36B '21.3':34B,80C '3.1':125C,134C '5.5':128C 'access':4A,43B,72C,111C,117C,122C 'affect':78C 'allow':85C 'attack':46B,88C,103C 'base':126C 'complet':116C 'compon':70C 'compromis':99C 'confidenti':129C 'critic':60B,113C 'cve':15A,18A 'cvss':124C,131C,133C 'data':8A,61B,114C,123C 'databas':22B 'database-repl':21B 'easili':82C 'execut':97C 'exploit':83C 'expos':7A 'flaw':6A,39B 'goldeng':2A,26B,32B,57B,69C,96C,101C,121C 'h/i':141C 'host':30B,55B 'impact':130C 'infrastructur':93C 'l/ac':136C 'l/pr':137C 'l/ui':138C 'local':10A 'logon':52B,90C 'low':12A,50B,86C 'low-privileg':11A,49B 'modul':5A,44B,73C 'n':143C 'n/a':142C 'n/s':139C 'oracl':1A,25B,31B,68C,95C,100C,120C 'oracle-goldeng':24B 'privileg':13A,51B,87C 'product':63B 'reach':65B 'read':59B 'replic':23B 'result':108C 'run':56B 'score':127C 'self':29B 'self-host':28B 'success':102C 'support':74C 'u/c':140C 'unauthor':110C 'user':14A 'vector':132C 'vendor':3A,42B,71C 'version':33B,75C 'vulner':66C,84C,106C","nicknames":[],"mitigations":[],"who_affected":"Hosts where Oracle GoldenGate 21.3 through 21.23 runs and where people without admin rights can log on. The sources do not say which deployment setups expose the Vendor Access Module by default, so teams should assume their installs are in scope until checked.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:18:13+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-101601","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101601","severity":null,"published_at":"2026-10-20T22:18:13+00:00","modified_at":"2026-10-21T18:43:53+00:00","first_seen_at":"2026-10-23T21:57:22+00:00","fetched_at":"2026-10-23T22:28:58+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}