CVE-2026-91530 in GoldenGate
Summary
by MITRE • 10/21/2026
Vulnerability in Oracle GoldenGate (component: Admin Client Executable). Supported versions that are affected are 23.4-23.26.2.0.0. Difficult to exploit vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle GoldenGate. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle GoldenGate accessible data. CVSS 3.1 Base Score 4.4 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N).
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/21/2026
The identified vulnerability resides within the Admin Client Executable component of Oracle GoldenGate, specifically affecting supported versions ranging from 23.4 through 23.26.2.0.0. This security flaw is characterized by a difficulty in exploitation that necessitates specific conditions to be met before an attacker can successfully leverage it against the target system. The vulnerability allows for unauthorized access to critical data or complete compromise of all Oracle GoldenGate accessible data, representing a significant risk to data confidentiality within enterprise environments relying on this replication and integration software.
From a technical perspective, the flaw requires a high privileged attacker who already possesses network access via HTTP to initiate an attack vector against the affected components. The requirement for high privileges indicates that the vulnerability does not allow for unauthenticated remote code execution or privilege escalation from low-level accounts. Instead, it likely involves improper validation of inputs or state management issues within the administrative interface that can be exploited by someone who has already gained a foothold with elevated credentials on the network segment where Oracle GoldenGate is deployed. The attack vector being classified as Network (AV:N) and Authentication required (PR:H) aligns with CWE-287, which describes Improper Authentication, or potentially CWE-352 Cross-Site Request Forgery if the administrative interface lacks sufficient anti-CSRF protections for privileged actions.
The operational impact of this vulnerability is primarily centered on data confidentiality rather than integrity or availability. With a CVSS 3.1 Base Score of 4.4 and a vector indicating High Confidentiality impact but no Impact to Integrity or Availability, the primary consequence is the exposure of sensitive information stored within the replication streams or target databases managed by Oracle GoldenGate. An attacker exploiting this flaw could extract proprietary data, customer records, financial transactions, or other confidential business intelligence that flows through the golden gate infrastructure. This aligns with ATT&CK technique T1530 Data from Local System, where an adversary accesses and exfiltrates data directly from compromised systems without necessarily disrupting service operations immediately.
Mitigation strategies for this vulnerability should focus on strict access control and network segmentation. Organizations must ensure that only authorized personnel with legitimate business needs have high-privilege administrative accounts enabled within the Oracle GoldenGate environment. It is critical to enforce multi-factor authentication where supported and to rotate credentials regularly to limit the window of opportunity if a credential is compromised. Furthermore, since the attack vector involves HTTP access, administrators should restrict network connectivity to the Admin Client Executable interfaces using firewall rules or reverse proxies that allow traffic only from trusted management subnets. Disabling unnecessary administrative ports and services reduces the attack surface significantly.
Additionally, keeping Oracle GoldenGate updated to the latest patch level provided by Oracle is essential for resolving known vulnerabilities in the admin components. Security teams should monitor vendor advisories closely and apply patches during scheduled maintenance windows after thorough testing in non-production environments. Implementing robust logging and monitoring solutions can help detect anomalous administrative activities or unusual data access patterns that might indicate an exploitation attempt, allowing for rapid incident response before significant data exfiltration occurs.