# CVE-2026-101601: Oracle GoldenGate privilege escalation in Vendor Access Module

Source: https://junglewise.ai/threats/cve-2026-101601-vulnerability-in-oracle-goldengate-component-vendor-access  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-20. Updated: 2026-10-20  
License: CC BY 4.0 with a link back

CVE-2026-101601 · Severity: medium · CVSS 5.5 · Published 2026-10-20

Oracle GoldenGate is a data replication and synchronization tool used by enterprises to manage database operations. A flaw in its Vendor Access Module allows a low-privileged user with local access to the system running GoldenGate to gain unauthorized access to sensitive data. An attacker exploiting this could read confidential information stored in or processed by GoldenGate without proper authorization.

Technologies: [Oracle GoldenGate](https://junglewise.ai/threats/technologies/goldengate). Vendors: [Oracle](https://junglewise.ai/threats/vendors/oracle).

## Quick answers

**Is CVE-2026-101601 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-101601 being exploited in the wild.

**How severe is CVE-2026-101601?** Medium severity, with a CVSS score of 5.5, published 20 October 2026.

**Which products and versions are affected?** Oracle GoldenGate 21.3 through 21.23.

**Is there a fix for CVE-2026-101601?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-101601 attacked?** It is attacked with local access.

**Am I affected by CVE-2026-101601?** Check whether you run Oracle GoldenGate at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A local privilege escalation vulnerability exists in the Vendor Access Module component of Oracle GoldenGate versions 21.3–21.23. The vulnerability requires low-level privileges and local logon access but no user interaction; it allows an attacker to read sensitive data with high confidentiality impact while causing no integrity or availability issues. A fix is available in patched versions.

## Affected products

- Oracle GoldenGate 21.3 through 21.23

## Timeline

- 2026-10: disclosed

## References

- [https://www.oracle.com/security-alerts/cpuoct2026.html](https://www.oracle.com/security-alerts/cpuoct2026.html)

## Related threats

- [Oracle GoldenGate privilege escalation in Vendor Access Module](https://junglewise.ai/threats/cve-2026-91547-vulnerability-in-oracle-goldengate-component-vendor-access-module)
- [Oracle GoldenGate privilege escalation in Admin Client](https://junglewise.ai/threats/cve-2026-91530-vulnerability-in-oracle-goldengate-component-admin-client)
- [Oracle GoldenGate privilege escalation in Admin Server](https://junglewise.ai/threats/cve-2026-87351-vulnerability-in-oracle-goldengate-component-admin-server)
- [Oracle GoldenGate unauthenticated compromise in Config Service Executable](https://junglewise.ai/threats/cve-2026-61106-oracle-goldengate-unauthenticated-compromise-in-config-service)
- [Oracle GoldenGate unauthorized data access in Libraries](https://junglewise.ai/threats/cve-2026-61084-oracle-goldengate-unauthorized-data-access-in-libraries)