Oracle GoldenGate CVE-2026-91547

Exploitation requires the attacker to already hold a low-privileged account with logon access (PR:L, AV:L) to the infrastructure host where Oracle GoldenGate executes, and to interact with the Vendor Access Module component; there is no remote and no network-only path. Limiting factors: the attacker must be local/authenticated to the GoldenGate host, so external unauthenticated attackers cannot reach it directly; impact is restricted to data confidentiality (no integrity or availability effect). Affected deployments are Oracle GoldenGate 19.1.0.0.0-19.32.0.0, 21.3-21.23, and 23.4-23.26.3.0.0; patched builds from the Oracle October 2026 CPU are not exposed.

This is a moderate-severity, confidentiality-only issue (CVSS 3.1 base 5.5, vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) that is a genuine data-exposure concern but not an urgent, mass-exploitable priority. The attack vector is LOCAL (AV:L) and requires an already-authenticated low-privileged account (PR:L) with logon access to the host where Oracle GoldenGate runs, which substantially limits the attacker population to insiders or those who have already gained a foothold - this is the single biggest risk-reducing signal. Attack complexity is low (AC:L) and no user interaction is needed (UI:N), so once local access exists exploitation is straightforward. Impact is confined to confidentiality (C:H, I:N, A:N) with no scope change (S:U), meaning data disclosure but no integrity or availability loss. No EPSS score, CISA KEV listing, or public POC is present in the provided data, so there is no evidence of active or probable near-term exploitation; the local vector makes broad automated exploitation unlikely. Note a data conflict to verify: the input Tags label this 'Authentication Bypass,' but the Oracle description and CVSS PR:L both describe an authenticated low-privileged local attacker gaining unauthorized data access, not a bypass of authentication - treat the tag as likely mislabeled and rely on the CVSS vector.

A low-privileged user (or an attacker who has already compromised a non-privileged account) with interactive or shell logon to the server running Oracle GoldenGate abuses the Vendor Access Module to read data they are not authorized to see, potentially exposing all GoldenGate-accessible replicated data. No user interaction or additional privilege escalation is required, but local host access is a hard prerequisite. No public exploit code was identified in the provided data.