Oracle Secure Backup CVE-2026-101480

Exploitation requires network TCP reachability to the Oracle Secure Backup NDMP daemon (the backup data-movement protocol service) on a host running version 19.1.0.0.0 or 19.1.0.1.0; per CVSS PR:N/UI:N no authentication or user interaction is needed. The primary limiting factor is network exposure of the NDMP service - environments that firewall or segment the backup/NDMP port off from untrusted networks substantially reduce reachability. Impact is further limited to read access to only a subset of accessible data (C:L, I:N, A:N), so the flaw does not permit data modification, service disruption, or lateral privilege gain.

This is a medium-severity information-disclosure flaw (CVSS 3.1 5.3) in the NDMP daemon of Oracle Secure Backup. The CVSS vector (AV:N/AC:L/PR:N/UI:N) describes the strongest possible access profile - network reachable, low complexity, no privileges, no user interaction - so Oracle's own 'easily exploitable' wording is consistent with the metrics. However, impact is deliberately narrow: confidentiality-only and partial (C:L), with no integrity or availability effect (I:N/A:N) and no scope change (S:U), meaning an attacker gains unauthorized read access to only a subset of accessible data rather than full compromise. EPSS is not provided in the input, the CVE is NOT on CISA KEV, and no public exploit is referenced, so there is no signal of active or imminent mass exploitation. Net: this is a real but moderate priority - worth patching in the normal Oracle CPU cycle and prioritized where the NDMP daemon is network-exposed, but not an emergency given the limited impact and absence of exploitation evidence. NOTE: the input Tags include 'Authentication Bypass', which conflicts with the description - the flaw is characterized as unauthorized read access (information disclosure), not an authentication-bypass that grants broader control; verify the intended classification with Oracle.

An attacker with network reachability to the Oracle Secure Backup NDMP daemon's TCP port sends crafted protocol traffic without any credentials and retrieves a subset of backup-related data they should not be able to read. No public exploit code is identified at time of analysis, and because impact is confidentiality-only, the scenario is data leakage rather than system takeover.