Oracle Secure Backup: Improper access control allows takeover
Summary
Oracle Secure Backup versions 19.1.0.0.0 and 19.1.0.1.0 contain an access control flaw (CWE-284). An attacker with low privileges and local logon to the host running Secure Backup can take over the product. Because the scope changes, a successful attack can also affect other systems in the same infrastructure. The issue is listed in Oracle's October 2026 Critical Patch Update.
Affected
- Oracle Secure Backup 19.1.0.0.0
- Oracle Secure Backup 19.1.0.1.0
Fixed in
Unknown. The patch number and fixed release could not be retrieved. Check the patch availability section of Oracle's October 2026 advisory.
Workaround
- No vendor workaround found.
- Restrict local logon to the Secure Backup host to administrators only.
- Limit which users can log on to that server at all.
Exploitation
- No in-the-wild exploitation or public proof of concept known at the time of research.
- EPSS 0.00171 (secondary source; check FIRST.org for the current value).
- CISA SSVC: exploitation none, not automatable, total technical impact.
Our recommendation
- Check whether Oracle Secure Backup is installed.
- Patch in the next maintenance window using Oracle's October 2026 CPU; treat installations as high priority and isolated ones as medium priority.
- Restrict logon to the backup host now and monitor for unusual logons.
- Patch all Secure Backup CVEs in this CPU, including the remotely exploitable CVE-2026-109618, not only this one.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Oracle October 2026 Critical Patch Update www.oracle.com
- Vulners: CVE-2026-101481 vulners.com
- Strix: CVE-2026-101481 www.strix.ai
- Oracle Security Alert CVE-2026-109618 www.oracle.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 15:31.
Original description (NVD)
Vulnerability in Oracle Secure Backup (component: Device Management and Support). Supported versions that are affected are 19.1.0.0.0 and 19.1.0.1.0. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Secure Backup executes to compromise Oracle Secure Backup. While the vulnerability is in Oracle Secure Backup, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Secure Backup. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.