{"id":"CVE-2026-91547","kind":"vulnerability","aliases":["CVE-2026-91547"],"related":[],"title":"Oracle GoldenGate: Vendor Access Module flaw exposes data to low-privilege local users","description":"Vulnerability in Oracle GoldenGate (component: Vendor Access Module).  Supported versions that are affected are 19.1.0.0.0-19.32.0.0,   21.3-21.23 and   23.4-23.26.3.0.0. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle GoldenGate executes to compromise Oracle GoldenGate.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle GoldenGate accessible data. CVSS 3.1 Base Score 5.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).","summary":"Oracle GoldenGate's Vendor Access Module has a flaw that lets a low-privileged user who can log on to the host read data they should not see. The attack needs local logon to the infrastructure where GoldenGate runs and gives the attacker confidentiality impact only, with no integrity or availability loss according to the CVSS vector.","severity":"medium","cvss":5.5,"epss":0.00145,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["database-replication","oracle-goldengate","other","self-hosted"],"not_affected_if":["no-untrusted-local-logon","versions-outside-range"],"how_to_check":"- Check the installed GoldenGate version against the affected ranges: 19.1.0.0.0-19.32.0.0, 21.3-21.23 and 23.4-23.26.3.0.0.\n- Review which OS accounts have logon access to hosts running GoldenGate.","fix":"- Move GoldenGate to a release outside the affected ranges per Oracle's July 2026 Critical Patch Update advisory (version numbers unknown from the sources).\n- Restrict local logon to GoldenGate hosts to trusted administrators.","status":"open","published_at":"2026-10-20T22:20:58+00:00","first_seen_at":"2026-10-23T21:57:27+00:00","triaged_at":"2026-10-25T04:12:03+00:00","updated_at":"2026-10-25T12:38:51+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-10-25T04:12:03Z","model":"claude-haiku-5-5","output":{"fix":"- Move GoldenGate to a release outside the affected ranges per Oracle's July 2026 Critical Patch Update advisory (version numbers unknown from the sources).\n- Restrict local logon to GoldenGate hosts to trusted administrators.","reach":"local","title":"Oracle GoldenGate: Vendor Access Module flaw exposes data to low-privilege local users","impact":"medium","summary":"Oracle GoldenGate's Vendor Access Module has a flaw that lets a low-privileged user who can log on to the host read data they should not see. The attack needs local logon to the infrastructure where GoldenGate runs and gives the attacker confidentiality impact only, with no integrity or availability loss according to the CVSS vector.","category":"other","nicknames":[],"who_cares":["oracle-goldengate","database-replication","self-hosted"],"confidence":0.6,"needs_auth":"yes","worst_case":"low-privileged local user reads critical GoldenGate-accessible data","analyst_note":"Confirm the patch version and Vendor Access Module configuration details from Oracle's advisory, which the sources did not include.","how_to_check":"- Check the installed GoldenGate version against the affected ranges: 19.1.0.0.0-19.32.0.0, 21.3-21.23 and 23.4-23.26.3.0.0.\n- Review which OS accounts have logon access to hosts running GoldenGate.","needs_analyst":true,"not_affected_if":["versions-outside-range","no-untrusted-local-logon"],"who_is_affected":"Teams running Oracle GoldenGate in the affected version ranges are exposed, most of all where several users or service accounts can log on to the same host. Systems where GoldenGate runs only on hosts with no untrusted local users carry lower practical risk. Teams on versions outside the listed ranges can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000686,"input_tokens":3485,"output_tokens":675,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':16A,19A '-21.23':106C '-91547':17A,20A '/av':163C '19.1.0.0.0':103C '19.32.0.0':104C '21.3':105C '23.26.3.0.0':109C '23.4':108C '3.1':153C,162C '5.5':156C 'access':4A,35B,95C,139C,145C,150C 'accord':84B 'affect':101C 'allow':113C 'attack':61B,74B,116C,131C 'avail':82B 'base':154C 'complet':144C 'compon':93C 'compromis':127C 'confidenti':75B,157C 'critic':141C 'cve':15A,18A 'cvss':87B,152C,159C,161C 'data':8A,55B,142C,151C 'databas':22B 'database-repl':21B 'easili':110C 'execut':125C 'exploit':111C 'expos':7A 'flaw':6A,39B 'give':72B 'goldeng':2A,26B,32B,69B,92C,124C,129C,149C 'h/i':169C 'host':30B,53B 'impact':76B,158C 'infrastructur':67B,121C 'integr':80B 'l/ac':164C 'l/pr':165C 'l/ui':166C 'let':41B 'local':13A,63B 'log':49B 'logon':64B,118C 'loss':83B 'low':11A,44B,114C 'low-privileg':10A,43B 'modul':5A,36B,96C 'n':171C 'n/a':170C 'n/s':167C 'need':62B 'oracl':1A,25B,31B,91C,123C,128C,148C 'oracle-goldeng':24B 'privileg':12A,45B,115C 'read':54B 'replic':23B 'result':136C 'run':70B 'score':155C 'see':59B 'self':29B 'self-host':28B 'success':130C 'support':97C 'u/c':168C 'unauthor':138C 'user':14A,46B 'vector':88B,160C 'vendor':3A,34B,94C 'version':98C 'vulner':89C,112C,134C","nicknames":[],"mitigations":[],"who_affected":"Teams running Oracle GoldenGate in the affected version ranges are exposed, most of all where several users or service accounts can log on to the same host. Systems where GoldenGate runs only on hosts with no untrusted local users carry lower practical risk. Teams on versions outside the listed ranges can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:20:58+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-91547","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91547","severity":null,"published_at":"2026-10-20T22:20:58+00:00","modified_at":"2026-10-21T18:44:55+00:00","first_seen_at":"2026-10-23T21:57:27+00:00","fetched_at":"2026-10-23T22:29:01+00:00","note":null},{"source":"epss","external_id":"CVE-2026-91547","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-91547","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-25T12:38:51+00:00","fetched_at":"2026-10-25T12:38:51+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}