Oracle Secure Backup EUVD-2026-105899

Exploitation requires the attacker to already hold a low-privileged interactive logon on the infrastructure/host where Oracle Secure Backup (versions 19.1.0.0.0 or 19.1.0.1.0) executes, and to reach the Device Management and Support component - it is NOT remotely exploitable (AV:L). Limiting factors that reduce real-world risk: local access and valid authentication are mandatory (PR:L), so remote or unauthenticated attackers cannot trigger it; impact is confined to availability (service hang/crash), with no data disclosure or modification. The aggravating factor is the CVSS scope change, meaning the induced DoS may extend to additional products co-located with Oracle Secure Backup.

This is a moderate, availability-only vulnerability (CVSS 3.1 base 6.5) that does not warrant top-tier emergency prioritization. The CVSS vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H tells a consistent story: exploitation requires LOCAL access (AV:L) and an existing low-privileged logon (PR:L) to the host where Oracle Secure Backup runs, with low attack complexity and no user interaction. The only impact is availability (A:H, C:N/I:N) - a hang or repeatable crash producing a complete DoS - so there is no confidentiality or integrity exposure. The scope change (S:C) is the notable amplifier: Oracle states attacks may significantly impact additional products beyond Oracle Secure Backup itself, which is why a pure-DoS local flaw still reaches 6.5. No EPSS score was provided in the input, the CVE is NOT listed in CISA KEV, and no public POC is referenced, so there is no evidence of active or at-scale exploitation; the local-access-plus-authentication requirement makes mass or remote exploitation implausible and points to an insider or post-compromise lateral scenario rather than internet-facing risk. Key missing data to note explicitly: EPSS probability is absent, CWE is N/A, and no vendor advisory detail beyond the Oracle CPU October 2026 landing page is available. Net: patch during normal cycles; this is a real but bounded DoS issue, not a high-real-risk critical.

A low-privileged user who already has a logon on the server where Oracle Secure Backup executes sends crafted input to the vulnerable Device Management and Support component, causing the service to hang or repeatedly crash and producing a complete denial of service. Because the flaw carries a scope change, the resulting outage may cascade to additional dependent products on the host. No public exploit code is identified at time of analysis, and exploitation presupposes existing local access rather than remote reach.