{"id":"CVE-2026-101484","kind":"vulnerability","aliases":["CVE-2026-101484"],"related":[],"title":"Oracle Secure Backup: unauthenticated network attacker can take over server","description":"Vulnerability in Oracle Secure Backup (component: Backup and Restore).  Supported versions that are affected are 19.1.0.0.0 and   19.1.0.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TCP to compromise Oracle Secure Backup.  Successful attacks of this vulnerability can result in takeover of Oracle Secure Backup. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).","summary":"Oracle Secure Backup versions 19.1.0.0.0 and 19.1.0.1.0 contain a flaw in the Backup and Restore component. An unauthenticated attacker with TCP network access can take over the backup server, with full confidentiality, integrity and availability impact.","severity":"critical","cvss":9.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Oracle Secure Backup","fixed":[],"affected":"19.1.0.0.0, 19.1.0.1.0","ecosystem":"vendor"}],"ecosystems":[],"tags":["backup-servers","infrastructure","oracle","oracle-secure-backup","self-hosted"],"not_affected_if":["not-using-oracle-secure-backup","other-versions","version-not-19.1"],"how_to_check":"Run 'obtool --version' or check the Oracle Secure Backup Web Tool for the installed version: 19.1.0.0.0 or 19.1.0.1.0 is vulnerable. Also check whether the administrative server and its TCP ports are reachable from untrusted networks.","fix":"Apply the Oracle October 2026 Critical Patch Update for Oracle Secure Backup, using the Database patch availability document on My Oracle Support. The exact patched version is unknown from public sources. Until patched, restrict TCP access to the backup server to trusted admin and client hosts only.","status":"open","published_at":"2026-10-20T22:17:57+00:00","first_seen_at":"2026-10-23T21:57:22+00:00","triaged_at":"2026-10-23T22:38:57+00:00","updated_at":"2026-10-23T23:10:27+00:00","category":"infrastructure","confidence":0.7,"triage":{"at":"2026-10-23T22:38:57Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Oracle Secure Backup: unauthenticated network attacker can take over server","impact":"high","summary":"Oracle Secure Backup versions 19.1.0.0.0 and 19.1.0.1.0 contain a flaw in the Backup and Restore component. An unauthenticated attacker with TCP network access can take over the backup server, with full confidentiality, integrity and availability impact.","category":"infrastructure","who_cares":["oracle-secure-backup","backup-servers"],"confidence":0.7,"needs_auth":"no","worst_case":"Attacker takes over the backup server and its stored data","analyst_note":"Find the vendor patch or Oracle Security Alert for CVE-2026-101484 and confirm the fixed version; the sources give no fix or check steps.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["other-versions"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000483,"input_tokens":3054,"output_tokens":355,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Find the vendor patch or Oracle Security Alert for CVE-2026-101484 and confirm the fixed version; the sources give no fix or check steps.","search":"'-101484':13A,16A '-2026':12A,15A '/av':129C '19.1.0.0.0':36B,83C '19.1.0.1.0':38B,85C '3.1':116C,128C '9.8':119C 'access':54B,94C 'affect':81C 'allow':89C 'attack':6A,50B,91C,103C 'avail':66B,123C 'backup':3A,19A,21B,28B,34B,44B,59B,72C,74C,101C,114C 'backup-serv':20B 'base':117C 'compon':47B,73C 'compromis':98C 'confidenti':63B,120C 'contain':39B 'cve':11A,14A 'cvss':115C,125C,127C 'easili':86C 'exploit':87C 'flaw':41B 'full':62B 'h':137C 'h/a':136C 'h/i':135C 'host':31B 'impact':67B,124C 'infrastructur':23B 'integr':64B,121C 'l/pr':131C 'n/ac':130C 'n/s':133C 'n/ui':132C 'network':5A,53B,93C 'oracl':1A,24B,26B,32B,70C,99C,112C 'oracle':17A 'oracle-secure-backup':25B 'restor':46B,76C 'result':108C 'score':118C 'secur':2A,27B,33B,71C,100C,113C 'secure':18A 'self':30B 'self-host':29B 'server':10A,22B,60B 'success':102C 'support':77C 'take':8A,56B 'takeov':110C 'tcp':52B,96C 'u/c':134C 'unauthent':4A,49B,90C 'vector':126C 'version':35B,78C 'via':95C 'vulner':68C,88C,106C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:17:57+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-101484","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101484","severity":null,"published_at":"2026-10-20T22:17:57+00:00","modified_at":"2026-10-22T23:17:58+00:00","first_seen_at":"2026-10-23T21:57:22+00:00","fetched_at":"2026-10-23T22:28:58+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-101484:381","url":null,"severity":null,"published_at":"2026-10-23T23:10:27+00:00","modified_at":"2026-10-23T23:10:27+00:00","first_seen_at":"2026-10-23T23:10:27+00:00","fetched_at":"2026-10-23T23:10:27+00:00","note":"Confirmed in Oracle CPU Oct 2026 (cpuoct2026.html, released 2026-10-20): Secure Backup 19.1.0.0.0 and 19.1.0.1.0 affected, CVSS 9.8. No fixed version number is public; the patch details are in the Database patch availability document on My Oracle Support (login needed). No KEV listing, no public PoC (VulDB), no exploitation reported. Did not search X or other social sources. Siblings in the same CPU: CVE-2026-101479 and CVE-2026-101480."}],"documents":[{"id":1637,"url":"https://www.oracle.com/security-alerts/cpuoct2026.html","title":"Oracle Critical Patch Update Advisory - October 2026","kind":"advisory","source":"analyst","text":"Lists Oracle E-Business Suite, versions 12.2.3-12.2.15 as affected; patches via Patch Availability Document (MOS). Released 2026-10-20.","published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1824,"url":"https://cve.armis.com/CVE-2026-101484","title":"CVE-2026-101484 | Armis","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null},{"id":1827,"url":"https://www.cve.org/CVERecord?id=CVE-2026-101484","title":"CVE Record: CVE-2026-101484","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}