Live › vulnerability › CVE-2026-91547
Go to dashboardOracle GoldenGate's Vendor Access Module has a flaw that lets a low-privileged user who can log on to the host read data they should not see. The attack needs local logon to the infrastructure where GoldenGate runs and gives the attacker confidentiality impact only, with no integrity or availability loss according to the CVSS vector.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams running Oracle GoldenGate in the affected version ranges are exposed, most of all where several users or service accounts can log on to the same host. Systems where GoldenGate runs only on hosts with no untrusted local users carry lower practical risk. Teams on versions outside the listed ranges can skip it.
No product ranges from the sources yet.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Vulnerability in Oracle GoldenGate (component: Vendor Access Module). Supported versions that are affected are 19.1.0.0.0-19.32.0.0, 21.3-21.23 and 23.4-23.26.3.0.0. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle GoldenGate executes to compromise Oracle GoldenGate. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle GoldenGate accessible data. CVSS 3.1 Base Score 5.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).
This page as .md · .json · in your agent: get_signal("CVE-2026-91547")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.