---
id: "CVE-2026-101482"
kind: "vulnerability"
aliases: ["CVE-2026-101482"]
title: "Oracle Secure Backup: low-privileged local user can take over the backup server"
severity: "high"
cvss: 7.8
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["backup-servers", "infrastructure", "oracle-database", "oracle-secure-backup"]
not_affected_if: ["no-local-logon-accounts", "other-versions"]
published_at: "2026-10-20T22:17:57+00:00"
first_seen_at: "2026-10-23T21:57:22+00:00"
updated_at: "2026-10-25T03:10:02+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-101482", "first_seen_at": "2026-10-23T21:57:22+00:00"}]
---

# Oracle Secure Backup: low-privileged local user can take over the backup server

Oracle Secure Backup 19.1.0.0.0 and 19.1.0.1.0 contain a flaw in the Device Management and Support component. A low-privileged user with logon to the host running Oracle Secure Backup can take over the product.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Run `obtool version` or check the installed Oracle Secure Backup version in the admin console and compare against `19.1.0.0.0` and `19.1.0.1.0`
- Confirm which hosts have local logon accounts beyond the backup administrators

## Fix

- Move Oracle Secure Backup off `19.1.0.0.0` and `19.1.0.1.0` to a patched release listed in Oracle's Critical Patch Update advisory
- unknown: the sources do not name the fixed version

## Timeline

- 2026-10-23T21:57:22+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-101482

## From the sources

Vulnerability in Oracle Secure Backup (component: Device Management and Support).  Supported versions that are affected are 19.1.0.0.0 and   19.1.0.1.0. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Secure Backup executes to compromise Oracle Secure Backup.  Successful attacks of this vulnerability can result in takeover of Oracle Secure Backup. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_