The vulnerability exists in the Device Management and Support component of Oracle Secure Backup. An attacker who has low‑privileged access to the host where the backup service runs can exploit the flaw and take control of Oracle Secure Backup. Completion of the attack results in full compromise, allowing the attacker to view, modify, or delete backup data and to potentially access other services on the same host due to a scope change. The flaw falls under improper access control (CWE‑284). The vulnerability is considered easily exploitable, with the CVSS score reflecting high impact on confidentiality, integrity and availability (score 8.8).

Oracle Corporation's Oracle Secure Backup, versions 19.1.0.0.0 and 19.1.0.1.0.

The CVSS score of 8.8 classifies this as a high‑severity flaw, and without mitigations the EPSS score is currently unknown, but the description notes it is easily exploitable. The vulnerability is not listed in the CISA KEV catalog, yet the high severity and the fact that a local low‑privileged user can launch an attack raises the risk of compromise. The scope change may allow attackers to impact additional software on the same infrastructure. Given that the required limited local access is common in many environments, the likelihood of exploitation remains significant.