Oracle Secure Backup: Denial of service via unauthenticated TCP requests
Summary
Oracle Secure Backup 19.1 is affected by a vulnerability in the Backup and Restore component that allows an unauthenticated attacker with network access via TCP to crash or hang the service, causing a repeatable denial of service. Oracle rates it 8.6 (CVSS 3.1) and states that the scope changes, so attacks may also affect other products. No confidentiality or integrity impact is listed; the risk is availability, which matters because a down backup server can block restores after a ransomware or hardware incident.
Affected
- Oracle Secure Backup 19.1.0.0.0 - Oracle Secure Backup 19.1.0.1.0
Fixed in
Unknown. Oracle's October 2026 Critical Patch Update covers this issue, but the fixed build for 19.1 could not be confirmed. Check the patch availability details in Oracle's advisory or My Oracle Support before planning changes.
Workaround
No vendor workaround found. - Restrict network access to Oracle Secure Backup to the backup and administration networks. - Do not expose the service to the internet. - Route remote access to the backup server through a VPN or jump host.
Exploitation
Exploited in the wild: nothing found. CISA KEV: No. EPSS: 0.0046. Public proof of concept: nothing found, but the search was limited.
Our recommendation
- Confirm the Secure Backup version and whether the server is reachable from untrusted networks. - Restrict access to the backup network and do not expose the service to the internet. - Obtain the fixed 19.1 build from Oracle's advisory or My Oracle Support and apply the October 2026 Critical Patch Update fixes for all Secure Backup CVEs. - Monitor the backup server for crashes, restarts and hangs, and keep a manual restore path ready. - Plan the upgrade away from 19.1, as premier support ends on 30 September 2027. Priority: high if a 19.1 server is reachable from the network, otherwise medium.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Oracle Critical Patch Update Advisory - October 2026 www.oracle.com
- Oracle Critical Patch Update Advisory - October 2026 (verbose) www.oracle.com
- Vulners CVE-2026-101479 vulners.com
- Strix CVE-2026-101479 www.strix.ai
- VulDB 423204 vuldb.com
- Oracle Secure Backup 19 Installation and Configuration Guide docs.oracle.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 07:34.
Original description (NVD)
Vulnerability in Oracle Secure Backup (component: Backup and Restore). Supported versions that are affected are 19.1.0.0.0 and 19.1.0.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TCP to compromise Oracle Secure Backup. While the vulnerability is in Oracle Secure Backup, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Secure Backup. CVSS 3.1 Base Score 8.6 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H).
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.