This vulnerability resides in the Device Management and Support component of Oracle Secure Backup. An attacker who already possesses low‑privileged user logon rights to the host that runs the software can trigger a bug that causes Oracle Secure Backup to hang or crash repeatedly. The attack does not compromise data confidentiality or integrity but removes the ability to use the backup service and can potentially impact other related Oracle products if the vulnerability is exploited, extending the scope of the denial of service.

Oracle Secure Backup versions 19.1.0.0.0 and 19.1.0.1.0 are affected. Any deployment of these versions running with the Device Management component enabled is at risk.

The CVSS score of 6.5 indicates a moderate severity availability impact (A:H) with low attack complexity and low privileges required. The EPSS score is not available, but the vulnerability is not listed in CISA’s KEV catalog, suggesting no documented exploitation yet. Attackers need only local logon rights to the infrastructure where Oracle Secure Backup operates, after which they can exercise the flaw to disrupt the service. Because the component is exposed on the host and requires no network access, an internal attacker or credential compromise could easily exploit the flaw.