EUVD-2026-105900
GHSA-8q7p-756x-fwc2
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach OSB service over TCP
-
DeliverySend crafted unauthenticated request
-
ExploitTrigger Backup/Restore component flaw
-
ExecutionGain control of OSB process
-
ImpactFull takeover of Oracle Secure Backup
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication mechanism validation
MITRE ATT&CK
2 techniques across 2 tactics: Defense Evasion, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions beyond network reachability - the vendor states an unauthenticated attacker with network access via TCP can compromise Oracle Secure Backup, consistent with AV:N/AC:L/PR:N/UI:N, meaning default-configuration instances exposing the Backup and Restore service over the network are exploitable. The primary limiting factor is exposure: exploitation requires TCP network reach to the Oracle Secure Backup administrative/service port, so instances confined to isolated management networks or behind firewalls are materially harder to reach. Only versions 19.1.0.0.0 and 19.1.0.1.0 are listed as affected, so the version constraint further bounds the exposed population. |
| Impact | All available technical signals point to a severe, easy-to-exploit flaw: the Oracle-supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes a network-reachable, low-complexity attack requiring no authentication and no user interaction, and the description explicitly states an unauthenticated attacker with TCP network access can achieve full takeover of Oracle Secure Backup, consistent with the C:H/I:H/A:H impacts and 9.8 base score. However, the exploitation-likelihood signals that would elevate this to an active-response priority are absent or unknown: no EPSS score was provided, the CVE is not listed in CISA KEV, no public proof-of-concept is referenced, and no SSVC decision data was supplied. Thus there is no public exploit identified at time of analysis, and the high CVSS reflects worst-case impact and ease rather than confirmed real-world exploitation. The only reference is the Oracle October 2026 Critical Patch Update advisory, so patch availability is confirmed but no independent exploitation telemetry exists. Net assessment: high patch priority for any organization actually running the affected versions due to the unauthenticated-RCE-style profile, but current evidence suggests potential rather than observed exploitation - monitor for KEV/EPSS changes. |
| Exploit ScenarioDerived | An attacker with network reachability to the Oracle Secure Backup service sends crafted TCP traffic to the exposed Backup and Restore component without needing credentials or user interaction. Because the flaw is unauthenticated and low-complexity (AV:N/AC:L/PR:N/UI:N), a single successful request can lead to complete takeover of the Oracle Secure Backup instance. No public proof-of-concept exploit is currently identified. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Unauthenticated attackers with TCP network reach to Oracle Secure Backup 19.1.0.0.0 or 19.1.0.1.0 can take full control of the backup service, with high confidentiality, integrity and availability impact and a CVSS 3.1 base score of 9.8. The vendor rates the attack as low-complexity with no privileges or user interaction required, so network exposure is the main constraint. No public exploit was identified at time of analysis, and no CISA KEV entry was provided.
RemediationAI
Apply the Oracle Secure Backup fix published in the October 2026 Critical Patch Update advisory (https://www.oracle.com/security-alerts/cpuoct2026.html) for versions 19.1.0.0.0 and 19.1.0.1.0; patch availability is indicated per vendor advisory, but no exact patched version number is provided in the input, so confirm the target build in the advisory before upgrading. Until patching is complete, block TCP access to the Secure Backup administrative/Backup and Restore service ports at network boundaries and allow only trusted management hosts or backup clients; this reduces exposure but can break remote backup, restore and console operations for hosts not allowlisted. Remove or disable unnecessary network exposure of the Backup and Restore service and review logs for unexpected connections; disabling the service entirely is the strongest containment but stops backup and restore functionality.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Oracle Secure Backup is Oracle's tape backup and restore management product for Oracle databases and file systems, and the affected component is Backup and Restore. The provided data does not assign a CWE, so the precise root-cause class is not documented; operationally, the flaw is an unauthenticated, network-reachable compromise of the backup service over TCP, consistent with the CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H vector. Because backup infrastructure often holds high-value credentials, catalog data and restore authority, compromise of this service can expose backup data, allow tampering with recovery points, and disrupt availability. Only Oracle Secure Backup 19.1.0.0.0 and 19.1.0.1.0 are listed, and no CPE strings were supplied; defenders should inventory those versions and confirm the Backup and Restore service is not exposed beyond trusted management networks.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Vendor description confirms remote, unauthenticated, low-complexity TCP exploitation with no user interaction leading to full takeover, giving AV:N/AC:L/PR:N/UI:N and C:H/I:H/A:H.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in Oracle Secure Backup (component: Backup and Restore). Supported versions that are affected are 19.1.0.0.0 and 19.1.0.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TCP to compromise Oracle Secure Backup. Successful attacks of this vulnerability can result in takeover of Oracle Secure Backup. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Executive ViewAI
Oracle Secure Backup 19.1.0.0.0 and 19.1.0.1.0 deployments that are network-reachable represent a severe enterprise risk because compromise could give attackers control of a core recovery system, affecting backup confidentiality, integrity, and availability. Leadership should care because loss or tampering of backups can disrupt recovery from other incidents, expose sensitive data, and create regulatory and operational exposure. No public exploit identified at time of analysis, and no vendor-released patch identified at time of analysis, so exposure reduction must come from network isolation and monitoring.
No vendor-released patch identified at time of analysis; restrict TCP access to trusted administrative networks, segment backup infrastructure, require jump hosts or VPN for administration, monitor access and backup configuration changes, disable unused services, and maintain offline or immutable backups with tested restores.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB