{"id":"CVE-2026-91547","state":"PUBLISHED","title":"Vulnerability in Oracle GoldenGate (component: Vendor Access Module).  Supported versions that are affected are 19.1.0.0.0-19.32.0.0,   21.3-21.23 and   23.4-23.26.3.0.0. Easily ex","description":"Vulnerability in Oracle GoldenGate (component: Vendor Access Module).  Supported versions that are affected are 19.1.0.0.0-19.32.0.0,   21.3-21.23 and   23.4-23.26.3.0.0. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle GoldenGate executes to compromise Oracle GoldenGate.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle GoldenGate accessible data. CVSS 3.1 Base Score 5.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).","publishedAt":"2026-10-20T21:26:28.873Z","updatedAt":"2026-10-26T20:14:09.676Z","severity":{"score":5.5,"label":"Medium","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","source":"oracle"},"assigner":"oracle","products":["Oracle Corporation Oracle GoldenGate"],"affected":[{"vendor":"Oracle Corporation","product":"Oracle GoldenGate","versions":[{"version":"19.1.0.0.0","status":"affected","lessThanOrEqual":"19.32.0.0","versionType":"custom"},{"version":"21.3","status":"affected","lessThanOrEqual":"21.23","versionType":"custom"},{"version":"23.4","status":"affected","lessThanOrEqual":"23.26.3.0.0","versionType":"custom"}]}],"references":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"weaknesses":["CWE-269"],"ingestedAt":"2026-10-29T20:13:34.582Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/91xxx/CVE-2026-91547.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-91547","state":"PUBLISHED","datePublished":"2026-10-20T21:26:28.873Z","dateUpdated":"2026-10-26T20:14:09.676Z","assignerShortName":"oracle","assignerOrgId":"43595867-4340-4103-b7a2-9a5208d29a85","dateReserved":"2026-09-14T22:10:16.643Z"},"containers":{"cna":{"descriptions":[{"lang":"en-US","value":"Vulnerability in Oracle GoldenGate (component: Vendor Access Module).  Supported versions that are affected are 19.1.0.0.0-19.32.0.0,   21.3-21.23 and   23.4-23.26.3.0.0. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle GoldenGate executes to compromise Oracle GoldenGate.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle GoldenGate accessible data. CVSS 3.1 Base Score 5.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)."}],"affected":[{"vendor":"Oracle Corporation","product":"Oracle GoldenGate","versions":[{"version":"19.1.0.0.0","status":"affected","lessThanOrEqual":"19.32.0.0","versionType":"custom"},{"version":"21.3","status":"affected","lessThanOrEqual":"21.23","versionType":"custom"},{"version":"23.4","status":"affected","lessThanOrEqual":"23.26.3.0.0","versionType":"custom"}]}],"references":[{"url":"https://www.oracle.com/security-alerts/cpuoct2026.html","name":"Oracle Advisory","tags":["vendor-advisory"]}],"metrics":[{"cvssV3_1":{"attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE","version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","baseScore":5.5,"baseSeverity":"MEDIUM"}}],"problemTypes":[{"descriptions":[{"lang":"en-US","description":"Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle GoldenGate executes to compromise Oracle GoldenGate.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle GoldenGate accessible data."}]}],"providerMetadata":{"shortName":"oracle","orgId":"43595867-4340-4103-b7a2-9a5208d29a85","dateUpdated":"2026-10-20T21:26:28.873Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:oracle:goldengate:*:*:*:*:*:*:*:*","versionStartIncluding":"19.1.0.0.0","versionEndIncluding":"19.32.0.0"},{"vulnerable":true,"criteria":"cpe:2.3:a:oracle:goldengate:*:*:*:*:*:*:*:*","versionStartIncluding":"21.3","versionEndIncluding":"21.23"},{"vulnerable":true,"criteria":"cpe:2.3:a:oracle:goldengate:*:*:*:*:*:*:*:*","versionStartIncluding":"23.4","versionEndIncluding":"23.26.3.0.0"}]}]}]},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-10-26T20:13:40.328707Z","id":"CVE-2026-91547","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-269","type":"CWE","lang":"en","description":"CWE-269 Improper Privilege Management"}]}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-10-26T20:14:09.676Z"}}]}}}