{"id":"CVE-2026-101479","kind":"vulnerability","aliases":["CVE-2026-101479"],"related":[],"title":"Oracle Secure Backup: unauthenticated network crash causes denial of service","description":"Vulnerability in Oracle Secure Backup (component: Backup and Restore).  Supported versions that are affected are 19.1.0.0.0 and   19.1.0.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TCP to compromise Oracle Secure Backup.  While the vulnerability is in Oracle Secure Backup, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Secure Backup. CVSS 3.1 Base Score 8.6 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H).","summary":"Oracle Secure Backup versions 19.1.0.0.0 and 19.1.0.1.0 can be hung or crashed repeatedly by an unauthenticated attacker over TCP. The attack affects availability only, with no confidentiality or integrity loss stated, but the scope change means other products may be impacted.","severity":"high","cvss":8.6,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Oracle Secure Backup","fixed":[],"affected":"19.1.0.0.0, 19.1.0.1.0","ecosystem":"vendor"}],"ecosystems":[],"tags":["backup-servers","infrastructure","oracle","oracle-secure-backup","package","self-hosted"],"not_affected_if":["not-using-oracle-secure-backup","other-versions","version-not-19.1"],"how_to_check":"Run 'obtool --version' or check the Oracle Secure Backup Web Tool: 19.1.0.0.0 or 19.1.0.1.0 is affected. Check whether the administrative server's TCP ports are reachable from untrusted networks.","fix":"Apply the Oracle October 2026 Critical Patch Update for Oracle Secure Backup via the Database patch availability document on My Oracle Support. Exact patched version is not public (MOS login needed). Until patched, restrict TCP access to the backup server to trusted admin and client hosts.","status":"resolved","published_at":"2026-10-20T22:17:56+00:00","first_seen_at":"2026-10-23T21:57:22+00:00","triaged_at":"2026-10-23T22:39:36+00:00","updated_at":"2026-10-24T00:10:22+00:00","category":"package","confidence":0.75,"triage":{"at":"2026-10-23T22:39:36Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Oracle Secure Backup: unauthenticated network crash causes denial of service","impact":"low","summary":"Oracle Secure Backup versions 19.1.0.0.0 and 19.1.0.1.0 can be hung or crashed repeatedly by an unauthenticated attacker over TCP. The attack affects availability only, with no confidentiality or integrity loss stated, but the scope change means other products may be impacted.","category":"package","who_cares":["oracle-secure-backup","backup-servers"],"confidence":0.6,"needs_auth":"no","worst_case":"Backup service repeatedly hangs or crashes, causing complete denial of service.","analyst_note":"Confirm the patch version from Oracle's Critical Patch Update advisory and the NVD entry; the source gives no fixed version or check procedure.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["other-versions"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000493,"input_tokens":3086,"output_tokens":368,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm the patch version from Oracle's Critical Patch Update advisory and the NVD entry; the source gives no fixed version or check procedure.","search":"'-101479':13A,16A '-2026':12A,15A '/av':159C '19.1.0.0.0':37B,89C '19.1.0.1.0':39B,91C '3.1':149C,158C '8.6':152C 'abil':133C 'access':100C 'addit':120C 'affect':54B,87C 'allow':95C 'attack':49B,53B,97C,116C,125C 'avail':55B,153C 'backup':3A,19A,21B,28B,35B,78C,80C,107C,115C,147C 'backup-serv':20B 'base':150C 'c/c':164C 'caus':7A,135C 'chang':67B,123C 'complet':142C 'compon':79C 'compromis':104C 'confidenti':59B 'crash':6A,44B,141C 'cve':11A,14A 'cvss':148C,155C,157C 'denial':8A 'dos':143C 'easili':92C 'exploit':93C 'frequent':139C 'h':167C 'hang':137C 'host':32B 'hung':42B 'impact':73B,119C,154C 'infrastructur':23B 'integr':61B 'l/pr':161C 'loss':62B 'may':71B,117C 'mean':68B 'n/a':166C 'n/ac':160C 'n/i':165C 'n/s':163C 'n/ui':162C 'network':5A,99C 'oracl':1A,24B,26B,33B,76C,105C,113C,145C 'oracle':17A 'oracle-secure-backup':25B 'packag':29B 'product':70B,121C 'repeat':45B,140C 'restor':82C 'result':130C 'scope':66B,122C 'score':151C 'secur':2A,27B,34B,77C,106C,114C,146C 'secure':18A 'self':31B 'self-host':30B 'server':22B 'servic':10A 'signific':118C 'state':63B 'success':124C 'support':83C 'tcp':51B,102C 'unauthent':4A,48B,96C 'unauthor':132C 'vector':156C 'version':36B,84C 'via':101C 'vulner':74C,94C,110C,128C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:17:56+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-101479","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101479","severity":null,"published_at":"2026-10-20T22:17:56+00:00","modified_at":"2026-10-21T14:29:49+00:00","first_seen_at":"2026-10-23T21:57:22+00:00","fetched_at":"2026-10-23T22:28:58+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-101479:603","url":null,"severity":null,"published_at":"2026-10-24T00:10:22+00:00","modified_at":"2026-10-24T00:10:22+00:00","first_seen_at":"2026-10-24T00:10:22+00:00","fetched_at":"2026-10-24T00:10:22+00:00","note":"Confirmed in Oracle CPU Oct 2026 (cpuoct2026.html): Secure Backup 19.1.0.0.0 and 19.1.0.1.0 affected, CVSS 8.6 (S:C, A:H), patch via Database patch availability doc on MOS (login needed); no fixed version number public. No KEV/PoC/exploitation seen in sources checked; did not search social. Siblings: CVE-2026-101484, -101480, -101481."}],"documents":[{"id":1637,"url":"https://www.oracle.com/security-alerts/cpuoct2026.html","title":"Oracle Critical Patch Update Advisory - October 2026","kind":"advisory","source":"analyst","text":"Lists Oracle E-Business Suite, versions 12.2.3-12.2.15 as affected; patches via Patch Availability Document (MOS). Released 2026-10-20.","published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":2454,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101479","title":"NVD CVE-2026-101479","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}