---
id: "CVE-2026-101601"
kind: "vulnerability"
aliases: ["CVE-2026-101601"]
title: "Oracle GoldenGate: Vendor Access Module flaw exposes data to local low-privilege users"
severity: "medium"
cvss: 5.5
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["database-replication", "oracle-goldengate", "other", "self-hosted"]
not_affected_if: ["no-local-logon", "unaffected-version"]
published_at: "2026-10-20T22:18:13+00:00"
first_seen_at: "2026-10-23T21:57:22+00:00"
updated_at: "2026-10-25T04:12:20+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-101601", "first_seen_at": "2026-10-23T21:57:22+00:00"}]
---

# Oracle GoldenGate: Vendor Access Module flaw exposes data to local low-privilege users

Oracle GoldenGate versions 21.3 through 21.23 have a flaw in the Vendor Access Module. An attacker with a low-privilege logon on the host running GoldenGate can read critical data the product can reach.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed GoldenGate version against the affected range 21.3 to 21.23 in the Oracle GoldenGate home directory
- Confirm the Vendor Access Module is present on the host: unknown

## Fix

- Move Oracle GoldenGate to a release outside 21.3 to 21.23 as listed in Oracle's Critical Patch Update advisory: unknown
- Restrict local logon to hosts running GoldenGate to trusted accounts

## Timeline

- 2026-10-23T21:57:22+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-101601

## From the sources

Vulnerability in Oracle GoldenGate (component: Vendor Access Module).  Supported versions that are affected are 21.3-21.23. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle GoldenGate executes to compromise Oracle GoldenGate.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle GoldenGate accessible data. CVSS 3.1 Base Score 5.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_