Oracle Secure Backup: Improper access control in Device Management
Summary
Oracle Secure Backup 19.1.0.0.0 and 19.1.0.1.0 contain a vulnerability in the Device Management and Support component, classified as improper access control (CWE-284). An attacker with low privileges and logon to the infrastructure where Oracle Secure Backup runs can take over the product, with high impact on confidentiality, integrity and availability. The attack vector is local (AV:L), so the product is not directly reachable from the internet, but any stolen low-privilege credential or compromised workstation on the backup network can be enough.
Affected
- Oracle Secure Backup 19.1.0.0.0
- Oracle Secure Backup 19.1.0.1.0
Fixed in
- Unknown. Oracle lists this CVE as fixed in its October 2026 Critical Patch Update, but the fixed build number was not retrieved. Check Oracle's patch availability documentation or My Oracle Support.
Workaround
- Unknown. Oracle's advisory does not describe a workaround for this CVE.
Exploitation
- No evidence found of exploitation in the wild, public proof of concept or CISA KEV listing.
- CISA SSVC assessment: exploitation none, not automatable, total technical impact.
- EPSS score 0.00171, which is very low.
Our recommendation
- Check whether Oracle Secure Backup 19.1.x is in use in your environment.
- Apply Oracle's October 2026 patch once the fixed build is confirmed. Patch together with the separate out-of-band fix for CVE-2026-109618 and CVE-2026-109619, which is network-exploitable without authentication.
- Limit logon to the backup server to named administrators, remove unused accounts and keep the backup server off general user networks.
- Monitor logons to the backup server.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Oracle Critical Patch Update, October 2026 www.oracle.com
- Oracle CPU October 2026 text risk matrices www.oracle.com
- Oracle security alert CVE-2026-109618 and CVE-2026-109619 www.oracle.com
- CVE record mirror (Vulners) vulners.com
- Tenable, October 2026 CPU summary www.tenable.com
- Strix CVE aggregator (third party) www.strix.ai
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 23:28.
Original description (NVD)
Vulnerability in Oracle Secure Backup (component: Device Management and Support). Supported versions that are affected are 19.1.0.0.0 and 19.1.0.1.0. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Secure Backup executes to compromise Oracle Secure Backup. Successful attacks of this vulnerability can result in takeover of Oracle Secure Backup. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.