Oracle Secure Backup CVE-2026-101482

Exploitation requires the attacker to already possess a valid low-privileged logon (PR:L) on the infrastructure/host where Oracle Secure Backup executes, and to reach the Device Management and Support component locally (AV:L) - there is no remote or unauthenticated path and no user interaction is needed (UI:N). Affected deployments are specifically Oracle Secure Backup 19.1.0.0.0 and 19.1.0.1.0. The key limiting factors are therefore the need for pre-existing local authentication and local access to the OSB server; systems where only trusted administrators have host logon, or that are not on the two affected versions, face substantially reduced realistic risk despite the 7.8 score.

This is a genuine but access-gated priority rather than a drop-everything internet-facing crisis. The Oracle-provided CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8) is internally consistent and dependable: it requires LOCAL access (AV:L) and an existing low-privileged logon (PR:L) to the host where Oracle Secure Backup executes, but once that foothold exists the attack is low-complexity with no user interaction and yields full confidentiality, integrity, and availability compromise (complete takeover of Oracle Secure Backup). No EPSS score, no CISA KEV listing, and no public POC were provided in the intelligence set, so there is no public exploit identified at time of analysis and no evidence of active exploitation - the risk is driven entirely by the intrinsic severity, not by observed attacker interest. Note a signal tension worth flagging: the input Tags label this 'Information Disclosure,' but the vector and description (C:H/I:H/A:H, 'takeover') describe full compromise, not mere disclosure - treat the tag as under-stating impact. The practical risk ceiling is set by the AV:L/PR:L prerequisite: an attacker must already be authenticated on the OSB host, which typically means this is a privilege-escalation / insider or post-foothold lateral-movement issue rather than a remotely-wormable one.

An attacker who already holds a low-privileged local account on the server running Oracle Secure Backup (for example via prior compromise of another service or a malicious insider) abuses the Device Management and Support component to escalate to full control of the backup system. No user interaction and no elevated privileges are needed beyond the initial logon, and because backups often hold the organization's most sensitive data and recovery capability, takeover enables data theft, tampering, and destruction of recovery points. No public exploit code is known at time of analysis.