---
id: "CVE-2026-101481"
kind: "vulnerability"
aliases: ["CVE-2026-101481"]
title: "Oracle Secure Backup: low-privilege local user can take over backup server"
severity: "high"
cvss: 8.8
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "Oracle Secure Backup", "fixed": [], "affected": "19.1.0.0.0, 19.1.0.1.0", "ecosystem": "vendor"}]
ecosystems: []
tags: ["infrastructure", "oracle-secure-backup", "self-hosted"]
not_affected_if: ["no-local-logon", "no-local-user-access", "other-versions"]
published_at: "2026-10-20T22:17:57+00:00"
first_seen_at: "2026-10-23T21:57:22+00:00"
updated_at: "2026-10-24T00:10:26+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-101481", "first_seen_at": "2026-10-23T21:57:22+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-24T00:10:26+00:00"}]
---

# Oracle Secure Backup: low-privilege local user can take over backup server

Oracle Secure Backup 19.1.0.0.0 and 19.1.0.1.0 contain a flaw in Device Management and Support. A user with a low-privilege logon on the host running Oracle Secure Backup can take over the product and affect other systems in scope.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Oracle Secure Backup affected 19.1.0.0.0, 19.1.0.1.0 fixed ?

## How to check

Run the Oracle Secure Backup version check (for example 'obtool --version' on the admin host) or look at the installed OSB version. Versions 19.1.0.0.0 and 19.1.0.1.0 are affected. Also check whether untrusted users have local logons on the backup server.

## Fix

Apply the Oracle Secure Backup patch from the October 2026 Critical Patch Update. The patch availability document is 'Database' on My Oracle Support (login needed). The exact patched version or patch number was not published on the public pages. Until you patch, limit local logons on the backup server to trusted admins.

## Timeline

- 2026-10-23T21:57:22+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-101481
- 2026-10-24T00:10:26+00:00 analyst — Oracle CPU Oct 2026 lists Oracle Secure Backup 19.1.0.0.0 and 19.1.0.1.0 as affected; the patch is in the Database patch availability document on My Oracle Support, which needs a login. No fixed version is public, so fix is left as the CPU patch. No exploitation or PoC reported; no X or social search done. Sibling CVEs 101479 and 101480 are in the same CPU.

## Documents

- [advisory] Oracle Critical Patch Update Advisory - October 2026 https://www.oracle.com/security-alerts/cpuoct2026.html
- [advisory] Text Form of Oracle CPU October 2026 Risk Matrices https://www.oracle.com/security-alerts/cpuoct2026verbose.html
- [mentions] CVE Record: CVE-2026-101481 https://www.cve.org/CVERecord?id=CVE-2026-101481

## From the sources

Vulnerability in Oracle Secure Backup (component: Device Management and Support).  Supported versions that are affected are 19.1.0.0.0 and   19.1.0.1.0. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Secure Backup executes to compromise Oracle Secure Backup.  While the vulnerability is in Oracle Secure Backup, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in takeover of Oracle Secure Backup. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_