IT SBIT Services
Schneeberger
DEEN
CVE tracker

Oracle GoldenGate: Improper access control in Admin Server Executable

CVE-2026-87351High 8.8

← All vulnerabilities

Summary

Oracle GoldenGate versions 19.1.0.0.0 to 19.32.0.0, 21.3 to 21.23 and 23.4 to 23.26.3.0.0 are affected by CVE-2026-87351 in the Admin Server Executable component, which is reached over HTTPS. An attacker with network access and a low-privileged account can, without user interaction, compromise the product, with a CVSS 3.1 base score of 8.8. Exploitation requires valid low-privileged credentials, so the attacker must first gain an account. Oracle's CISA SSVC data lists exploitation as none and automatable as no.

Affected

  • Oracle GoldenGate 19.1.0.0.0 to 19.32.0.0
  • Oracle GoldenGate 21.3 to 21.23
  • Oracle GoldenGate 23.4 to 23.26.3.0.0

Fixed in

  • Oracle GoldenGate 21.x: 21.24.0.0.0 is reported by a secondary source (Tenable plugin title) and is not verified against Oracle.
  • Oracle GoldenGate 19.x: Unknown.
  • Oracle GoldenGate 23.x: Unknown.
  • Verify all fixed builds in the Oracle Critical Patch Update Advisory – October 2026 (Rev 2) before planning upgrades.

Workaround

  • No workaround is documented in the sources reviewed.
  • Restrict network access to the GoldenGate Admin Server port to known management hosts.
  • Do not expose the Admin Server to the internet.

Exploitation

  • No evidence of exploitation in the wild was found. The CISA KEV status was not confirmed.
  • No public proof of concept was found.
  • The vulnerability was reported by Positive Technologies (ref. PT-2026-119669).
  • EPSS data was not available.

Our recommendation

  • Check the asset inventory to determine whether GoldenGate is installed.
  • If installed, confirm the exact version and apply the October 2026 Critical Patch Update or the vendor's fixed build for your release line.
  • Keep the Admin Server off the internet and limit access to management hosts.
  • Review accounts with low-privileged GoldenGate access and remove unneeded accounts.
  • Monitor GoldenGate admin logs for unusual logins and changes.
  • Treat this as high priority only where the product exists and is reachable from less-trusted networks.

Public exploits

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 11:41.

Original description (NVD)

Vulnerability in Oracle GoldenGate (component: Admin Server Executable). Supported versions that are affected are 19.1.0.0.0-19.32.0.0, 21.3-21.23 and 23.4-23.26.3.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTPS to compromise Oracle GoldenGate. Successful attacks of this vulnerability can result in takeover of Oracle GoldenGate. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

NVD references (1)

Sources

The tracker combines official, freely usable data sources – updated continuously:

This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.

Affected? We can help.

We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.

Get in touchRSS feed