CVE-2026-91547

Status: Awaiting AnalysisMedium (5.5)—

Severity5.5Medium · CVSS 3.1

Exploitation probability0.14 %higher than 3% of CVEs

Active exploitationNonot in the CISA catalog

Public exploitNot knownno public code found

Vulnerability in Oracle GoldenGate (component: Vendor Access Module). Supported versions that are affected are 19.1.0.0.0-19.32.0.0, 21.3-21.23 and 23.4-23.26.3.0.0. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle GoldenGate executes to compromise Oracle GoldenGate. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle GoldenGate accessible data. CVSS 3.1 Base Score 5.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).

CVSS

Base score: 5.5
Version: 3.1
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Exploitation probability (EPSS)

Probability of exploitation in the next 30 days: 0.14 %
Percentile among all scored CVEs: 3
Score date: 10/21/2026

EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).

ATT&CK techniques

How this vulnerability is exploited and what the attacker gains, in MITRE ATT&CK terms.

ExploitationT1068 Exploitation for Privilege Escalationprivilege escalation90 %
Primary impactT1005 Data from Local Systemcollection70 %

El vector CVSS es AV:L/PR:L/UI:N, es decir, acceso local con bajo privilegio y sin interacción (T1068). El texto indica acceso no autorizado a datos críticos de GoldenGate (C:H), lo que sustenta T1005.

Inferred by our analysis agent from the official description, CVSS vector and CWE, and checked by a supervisor. May contain errors.

ATT&CK mitigations that cover these techniques

Threat Intelligence Program Execution Prevention Application Isolation and Sandboxing Exploit Protection Update Software Data Loss Prevention

Affected technologies (1)

⚠ AI-inferred from the description — NVD hasn't analyzed this CVE yet, these aren't verified CPEs.

Oracle — Goldengate^AI

References

Show 1 references

https://www.oracle.com/security-alerts/cpuoct2026.html

Raw JSON (NVD)

Show

{
  "id": "CVE-2026-91547",
  "cveTags": [],
  "metrics": {
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "secalert_us@oracle.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 5.5,
          "attackVector": "LOCAL",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 1.8
      }
    ]
  },
  "affected": [
    {
      "source": "secalert_us@oracle.com",
      "affectedData": [
        {
          "vendor": "Oracle Corporation",
          "product": "Oracle GoldenGate",
          "versions": [
            {
              "status": "affected",
              "version": "19.1.0.0.0",
              "versionType": "custom",
              "lessThanOrEqual": "19.32.0.0"
            },
            {
              "status": "affected",
              "version": "21.3",
              "versionType": "custom",
              "lessThanOrEqual": "21.23"
            },
            {
              "status": "affected",
              "version": "23.4",
              "versionType": "custom",
              "lessThanOrEqual": "23.26.3.0.0"
            }
          ]
        }
      ]
    }
  ],
  "published": "2026-10-20T22:20:58.083",
  "references": [
    {
      "url": "https://www.oracle.com/security-alerts/cpuoct2026.html",
      "source": "secalert_us@oracle.com"
    }
  ],
  "vulnStatus": "Awaiting Analysis",
  "descriptions": [
    {
      "lang": "en",
      "value": "Vulnerability in Oracle GoldenGate (component: Vendor Access Module).  Supported versions that are affected are 19.1.0.0.0-19.32.0.0,   21.3-21.23 and   23.4-23.26.3.0.0. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle GoldenGate executes to compromise Oracle GoldenGate.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle GoldenGate accessible data. CVSS 3.1 Base Score 5.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)."
    }
  ],
  "lastModified": "2026-10-21T18:44:55.490",
  "sourceIdentifier": "secalert_us@oracle.com"
}