This vulnerability exists in the Device Management and Support component of Oracle Secure Backup and permits a low‑privileged user who is logged on to the same infrastructure where the backup engine runs to gain control of the application. The flaw enables the attacker to compromise the security of the backup service, resulting in full loss of confidentiality, integrity, and availability of the data protected by the system.

Oracle Secure Backup versions 19.1.0.0.0 and 19.1.0.1.0 are affected. No other Oracle products are listed as vulnerable.

The CVSS 3.1 base score of 7.8 reflects high severity. The vulnerability can be exploited by an attacker who has local logon to the host running the Secure Backup engine. The EPSS score of 0.00162 indicates a very low probability of exploitation in the wild, yet the local nature of the attack and the high impact make it a significant risk for environments that share hosts or have weak local access controls. The flaw is not listed in the CISA KEV catalog.