{"id":"CVE-2026-101481","kind":"vulnerability","aliases":["CVE-2026-101481"],"related":[],"title":"Oracle Secure Backup: low-privilege local user can take over backup server","description":"Vulnerability in Oracle Secure Backup (component: Device Management and Support).  Supported versions that are affected are 19.1.0.0.0 and   19.1.0.1.0. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Secure Backup executes to compromise Oracle Secure Backup.  While the vulnerability is in Oracle Secure Backup, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in takeover of Oracle Secure Backup. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).","summary":"Oracle Secure Backup 19.1.0.0.0 and 19.1.0.1.0 contain a flaw in Device Management and Support. A user with a low-privilege logon on the host running Oracle Secure Backup can take over the product and affect other systems in scope.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Oracle Secure Backup","fixed":[],"affected":"19.1.0.0.0, 19.1.0.1.0","ecosystem":"vendor"}],"ecosystems":[],"tags":["infrastructure","oracle-secure-backup","self-hosted"],"not_affected_if":["no-local-logon","no-local-user-access","other-versions"],"how_to_check":"Run the Oracle Secure Backup version check (for example 'obtool --version' on the admin host) or look at the installed OSB version. Versions 19.1.0.0.0 and 19.1.0.1.0 are affected. Also check whether untrusted users have local logons on the backup server.","fix":"Apply the Oracle Secure Backup patch from the October 2026 Critical Patch Update. The patch availability document is 'Database' on My Oracle Support (login needed). The exact patched version or patch number was not published on the public pages. Until you patch, limit local logons on the backup server to trusted admins.","status":"open","published_at":"2026-10-20T22:17:57+00:00","first_seen_at":"2026-10-23T21:57:22+00:00","triaged_at":"2026-10-23T22:32:45+00:00","updated_at":"2026-10-24T00:10:26+00:00","category":"infrastructure","confidence":0.7,"triage":{"at":"2026-10-23T22:32:45Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Oracle Secure Backup: low-privilege local user can take over backup server","impact":"high","summary":"Oracle Secure Backup 19.1.0.0.0 and 19.1.0.1.0 contain a flaw in Device Management and Support. A user with a low-privilege logon on the host running Oracle Secure Backup can take over the product and affect other systems in scope.","category":"infrastructure","who_cares":["oracle-secure-backup","self-hosted"],"confidence":0.7,"needs_auth":"yes","worst_case":"attacker takes over backup server and reaches other systems","analyst_note":"Check the Oracle Critical Patch Update advisory for the fixed version and the vendor's guidance on mitigations; the NVD entry does not give one.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["other-versions","no-local-logon"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000486,"input_tokens":3085,"output_tokens":355,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check the Oracle Critical Patch Update advisory for the fixed version and the vendor's guidance on mitigations; the NVD entry does not give one.","search":"'-101481':16A,19A '-2026':15A,18A '/av':155C '19.1.0.0.0':34B,87C '19.1.0.1.0':36B,89C '3.1':142C,154C '8.8':145C 'addit':124C 'affect':66B,85C 'allow':93C 'attack':96C,120C,129C 'avail':149C 'backup':3A,12A,22A,27B,33B,59B,75C,105C,111C,119C,140C 'base':143C 'c/c':160C 'chang':127C 'compon':76C 'compromis':108C 'confidenti':146C 'contain':37B 'cve':14A,17A 'cvss':141C,151C,153C 'devic':41B,77C 'easili':90C 'execut':106C 'exploit':91C 'flaw':39B 'h':163C 'h/a':162C 'h/i':161C 'host':30B,55B 'impact':123C,150C 'infrastructur':23B,101C 'integr':147C 'l/ac':156C 'l/pr':157C 'l/ui':158C 'local':7A 'logon':52B,98C 'low':5A,50B,94C 'low-privileg':4A,49B 'manag':42B,78C 'may':121C 'n/s':159C 'oracl':1A,25B,31B,57B,73C,103C,109C,117C,138C 'oracle':20A 'oracle-secure-backup':24B 'privileg':6A,51B,95C 'product':64B,125C 'result':134C 'run':56B 'scope':70B,126C 'score':144C 'secur':2A,26B,32B,58B,74C,104C,110C,118C,139C 'secure':21A 'self':29B 'self-host':28B 'server':13A 'signific':122C 'success':128C 'support':44B,80C,81C 'system':68B 'take':10A,61B 'takeov':136C 'user':8A,46B 'vector':152C 'version':82C 'vulner':71C,92C,114C,132C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:17:57+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-101481","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101481","severity":null,"published_at":"2026-10-20T22:17:57+00:00","modified_at":"2026-10-23T12:18:05+00:00","first_seen_at":"2026-10-23T21:57:22+00:00","fetched_at":"2026-10-23T22:28:58+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-101481:602","url":null,"severity":null,"published_at":"2026-10-24T00:10:26+00:00","modified_at":"2026-10-24T00:10:26+00:00","first_seen_at":"2026-10-24T00:10:26+00:00","fetched_at":"2026-10-24T00:10:26+00:00","note":"Oracle CPU Oct 2026 lists Oracle Secure Backup 19.1.0.0.0 and 19.1.0.1.0 as affected; the patch is in the Database patch availability document on My Oracle Support, which needs a login. No fixed version is public, so fix is left as the CPU patch. No exploitation or PoC reported; no X or social search done. Sibling CVEs 101479 and 101480 are in the same CPU."}],"documents":[{"id":1637,"url":"https://www.oracle.com/security-alerts/cpuoct2026.html","title":"Oracle Critical Patch Update Advisory - October 2026","kind":"advisory","source":"analyst","text":"Lists Oracle E-Business Suite, versions 12.2.3-12.2.15 as affected; patches via Patch Availability Document (MOS). Released 2026-10-20.","published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1639,"url":"https://www.oracle.com/security-alerts/cpuoct2026verbose.html","title":"Text Form of Oracle CPU October 2026 Risk Matrices","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":2459,"url":"https://www.cve.org/CVERecord?id=CVE-2026-101481","title":"CVE Record: CVE-2026-101481","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}