Oracle Secure Backup CVE-2026-101481

Exploitation requires the attacker to already have a low-privileged local logon on the infrastructure where Oracle Secure Backup executes (AV:L, PR:L) - this is the key limiting factor and means it is not remotely reachable from an untrusted network without a prior foothold. The specific weakness lies in the Device Management and Support component of Oracle Secure Backup versions 19.1.0.0.0 and 19.1.0.1.0. No user interaction is required (UI:N) and attack complexity is low (AC:L), so once local access exists, exploitation is straightforward against affected versions. The scope change (S:C) means successful compromise can extend beyond Oracle Secure Backup to additional products on the host. Authentication is required (authenticated attacker, per PR:L); unaffected versions and non-19.1.x deployments are outside scope.

This is a credible high-priority vulnerability but not an emergency drop-everything item. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, base 8.8) tells a consistent story: exploitation requires LOCAL access (AV:L) and some existing privilege (PR:L), but once those preconditions are met the attack is low-complexity, needs no user interaction, causes a scope change, and yields full confidentiality/integrity/availability compromise (product takeover). The high 8.8 score is driven almost entirely by the scope change and total-impact triad rather than by ease of reach - this is NOT a remote unauthenticated flaw. No EPSS score was provided in the input, so exploitation probability cannot be quantified. The CVE is NOT on CISA KEV and no public exploit code is referenced, so there is no public exploit identified at time of analysis. The description's claim that attacks 'may significantly impact additional products' aligns with the S:C (scope change) in the vector, so those two signals are consistent. The one tension worth flagging: the input Tags label this 'Information Disclosure,' but the CVSS vector shows full Integrity and Availability impact plus takeover - the vulnerability is far broader than information disclosure, so defenders should not down-scope remediation based on that tag.

A user who already holds a low-privilege local logon on the host where Oracle Secure Backup runs (for example a limited service or operator account) abuses the Device Management and Support component to escalate to full control of the Oracle Secure Backup instance. Because the vulnerability causes a scope change, the attacker can then pivot to impact additional products beyond Oracle Secure Backup itself. No public exploit code is identified at time of analysis, and exploitation requires pre-existing local access, which limits opportunistic use.