The vulnerability resides in the NDMP daemon component of Oracle Secure Backup, which allows an attacker to connect over TCP without any authentication. Once connected, the attacker can read a subset of backup data that the application exposes to the network. The impact is limited to confidentiality, as the flaw does not affect integrity or availability.

Oracle Secure Backup versions 19.1.0.0.0 and 19.1.0.1.0 are affected. All installations that use the NDMP interface and have not applied the official update are vulnerable.

The CVSS base score is 5.3, indicating a medium severity vulnerability with local confidentiality impact. EPSS data is not available, and the issue is not listed in the CISA KEV catalog. Attackers with network access can exploit the flaw remotely via TCP, requiring no additional authentication or privileged state. Because exploitation is straightforward, the overall risk is moderate, but the lack of exploitation evidence means the real-world threat is currently limited.