Description
Vulnerability in Oracle Secure Backup (component: Backup and Restore). Supported versions that are affected are 19.1.0.0.0 and 19.1.0.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TCP to compromise Oracle Secure Backup. While the vulnerability is in Oracle Secure Backup, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Secure Backup. CVSS 3.1 Base Score 8.6 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H).
Published: 2026-10-20
Score: 8.6 High
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service
Action: Apply Patch
AI Analysis

Impact

The vulnerability resides in the Backup and Restore component of Oracle Secure Backup. An unauthenticated attacker with network connectivity to the service over TCP can exploit it to cause the application to hang or repeatedly crash, leading to a complete denial of service. The CVSS v3.1 base score of 8.6 highlights a severe availability impact, and the flaw introduces a scope change that may affect other related products.

Affected Systems

Oracle Secure Backup versions 19.1.0.0.0 and 19.1.0.1.0, released by Oracle Corporation.

Risk and Exploitability

The high CVSS score indicates serious risk; no EPSS data is available and the vulnerability is not listed in the CISA KEV catalog. The description characterizes the flaw as easily exploitable, meaning an attacker only needs to send traffic to the exposed TCP port—no credentials or elevated privileges are required. The scope change allows the impact to spread beyond the service itself to other components that interact with the Backup and Restore module.

Generated by OpenCVE AI on October 22, 2026 at 09:38 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the vendor‐provided patch or upgrade Oracle Secure Backup to a non‑affected version for releases 19.1.0.0.0 and 19.1.0.1.0.
  • If a patch is unavailable, isolate the Secure Backup service from untrusted networks by configuring firewall rules or access control lists to restrict TCP access to trusted hosts.
  • Continuously monitor system logs and network traffic for abnormal connection attempts or frequent crashes that could indicate exploitation attempts.

Generated by OpenCVE AI on October 22, 2026 at 09:38 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 05 Nov 2026 17:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 22 Oct 2026 10:00:00 +0000

Type Values Removed Values Added
Title Unauthenticated Remote Denial of Service via TCP in Oracle Secure Backup
Weaknesses CWE-400

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Vulnerability in Oracle Secure Backup (component: Backup and Restore). Supported versions that are affected are 19.1.0.0.0 and 19.1.0.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TCP to compromise Oracle Secure Backup. While the vulnerability is in Oracle Secure Backup, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Secure Backup. CVSS 3.1 Base Score 8.6 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H).
First Time appeared Oracle
Oracle secure Backup
CPEs cpe:2.3:a:oracle:secure_backup:19.1.0.0.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:secure_backup:19.1.0.1.0:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle secure Backup
References
Metrics cvssV3_1

{'score': 8.6, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H'}

Subscriptions

Oracle Secure Backup
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-11-05T16:00:49.917Z

Reserved: 2026-09-28T15:40:09.486Z

Link: CVE-2026-101479

cve-icon Vulnrichment

Updated: 2026-11-05T16:00:46.663Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-20T22:17:56.950

Modified: 2026-11-05T16:17:22.657

Link: CVE-2026-101479

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-23T00:30:08Z

Weaknesses
  • CWE-400

    Uncontrolled Resource Consumption