EUVD-2026-105895
GHSA-9jqc-r5p3-qj9x
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach OSB service over TCP
-
ExploitSend crafted malicious packets
-
ExecutionTrigger hang or repeatable crash
-
ImpactComplete DoS with scope impact
Vulnerability Assessment
| Exploitation Conditions | No special configuration conditions are stated in the description - exploitation requires only network access to the Oracle Secure Backup service over TCP against versions 19.1.0.0.0 or 19.1.0.1.0, with no authentication (PR:N) and no user interaction (UI:N). The practical limiting factor is network exposure: the attacker must be able to reach the OSB listening service, so deployments that firewall or segment the backup service away from untrusted networks substantially reduce realistic exposure. Impact is limited to availability (service hang/repeatable crash); there is no confidentiality or integrity impact, though the scope change means collateral availability impact to dependent products is possible. |
| Impact | This is a genuine high-priority availability risk for environments that run the affected product, but the signals are mixed. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes an easily exploitable, remote, unauthenticated, no-interaction flaw over TCP, and the 8.6 score is driven entirely by availability (A:H) amplified by a scope change (S:C) - confidentiality and integrity are untouched (C:N/I:N), so this is a pure denial-of-service, not a code-execution or data-breach issue. No EPSS score was provided in the input, and there is no CISA KEV listing and no public proof-of-concept referenced, so exploitation likelihood cannot be quantified from the data; the only reference is the Oracle October 2026 Critical Patch Update advisory. Net assessment: patch promptly where Oracle Secure Backup is internet- or network-reachable because exploitation is trivial and unauthenticated, but the absence of EPSS/KEV/POC signals and the availability-only impact mean this is more of a service-disruption concern than a confirmed, widespread, actively-exploited emergency. The high score reflects ease and scope, not real-world exploitation evidence. |
| Exploit ScenarioDerived | An unauthenticated attacker with network reachability to an Oracle Secure Backup service sends crafted TCP traffic to the Backup and Restore component, triggering a condition that hangs or repeatedly crashes the service and produces a complete denial of service. Because the vulnerability carries a scope change, the disruption may cascade beyond Oracle Secure Backup to dependent backup/restore operations and other products. No public exploit code was identified at time of analysis, so this scenario is inferred from the CVSS vector rather than a demonstrated POC. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Unauthenticated remote attackers can cause a hang or frequently repeatable crash of Oracle Secure Backup 19.1.0.0.0 and 19.1.0.1.0 by reaching its TCP-exposed service, resulting in complete denial of service with a CVSS 3.1 base score of 8.6 and a scope change that may affect dependent products. This is a genuine high-priority availability risk for environments that run the affected product, but the signals are mixed: no public exploit or CISA KEV entry was provided in the available data, and practical exposure depends on whether the backup service is reachable from untrusted networks. Exploitation requires only network access, with no authentication and no user interaction per the assessed vector.
RemediationAI
No exact fixed version is specified in the provided data; the primary action is to review and apply the Oracle Critical Patch Update (CPU) October 2026 guidance at https://www.oracle.com/security-alerts/cpuoct2026.html and upgrade Oracle Secure Backup 19.1.0.0.0 or 19.1.0.1.0 to the vendor-designated fixed release once confirmed. Until the vendor fix is applied, reduce exposure by restricting TCP access to the Oracle Secure Backup service with firewall rules or network segmentation so that only trusted backup networks and clients can reach it; this lowers the remote attack surface but can disrupt legitimate backup traffic and requires careful allowlisting. Monitor service availability and logs for repeated hangs or crashes, and validate that any compensating access-control changes do not block required backup and restore operations.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Oracle Secure Backup is Oracle's backup and restore product, and the affected component is Backup and Restore. The vulnerability is a network-reachable denial-of-service condition in which an unauthenticated attacker can use TCP access to cause a hang or frequently repeatable crash of the service, as reflected by CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H. The scope change (S:C) means that while the flaw resides in Oracle Secure Backup, successful attacks may significantly impact additional products; impact is limited to availability, with no confidentiality or integrity impact stated. No CWE identifier was provided, so the precise root-cause class cannot be confirmed from the available data. The practical limiting factor is network exposure: the attacker must be able to reach the Oracle Secure Backup listening service, so firewalling or segmenting the backup service away from untrusted networks substantially reduces realistic exposure.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
Remote unauthenticated TCP attack with no interaction (AV:N/AC:L/PR:N/UI:N); availability-only DoS (A:H, C:N/I:N) with cross-product impact justifying scope change (S:C).
Primary rating from NVD.
CVSS VectorNVD
DescriptionNVD
Vulnerability in Oracle Secure Backup (component: Backup and Restore). Supported versions that are affected are 19.1.0.0.0 and 19.1.0.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TCP to compromise Oracle Secure Backup. While the vulnerability is in Oracle Secure Backup, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Secure Backup. CVSS 3.1 Base Score 8.6 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H).
Executive ViewAI
Oracle Secure Backup 19.1.0.0.0 and 19.1.0.1.0 carry a high-severity availability vulnerability that can allow a network attacker to crash or hang the backup service, disrupting backup operations and potentially dependent systems. No vendor-released patch identified at time of analysis, and no public exploit identified at time of analysis, so leadership should focus on reducing network exposure while preparing for a vendor fix.
No vendor patch available; restrict TCP access to trusted management networks, segment backup infrastructure, monitor service availability and abnormal connections, and maintain offline or immutable backups to support recovery.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Exploit-DB