CVE-2026-101480
MediumCVSS 5.3Summary
Vulnerability in Oracle Secure Backup (component: NDMP daemon). An unauthenticated attacker with network access via TCP can easily exploit this vulnerability, resulting in unauthorized read access to a subset of Oracle Secure Backup accessible data.
Risk Assessment
An attacker could gain unauthorized access to sensitive data without authentication, potentially compromising confidentiality of backup information.
Recommendation
Update Oracle Secure Backup to the latest version and restrict network access to the NDMP daemon.
Other vulnerabilities in Oracle Secure Backup
See all- CVE-2026-101483Medium
Vulnerability in Oracle Secure Backup (component: Device Management and Support) affecting versions 19.1.0.0.0 and 19.1.0.1.0. A low-privileged attacker with logon to the infrastructure where the component executes can cause a hang or frequently repeatable crash (complete denial of service), and the attack may impact additional products.
- CVE-2026-101482High
Vulnerability in Oracle Secure Backup (Device Management and Support component) versions 19.1.0.0.0 and 19.1.0.1.0. An easily exploitable local attack by a low-privileged attacker can lead to takeover of Oracle Secure Backup.
- CVE-2026-101481High
Vulnerability in Oracle Secure Backup (Device Management and Support component) versions 19.1.0.0.0 and 19.1.0.1.0. An easily exploitable local attack by a low-privileged attacker can lead to takeover of Oracle Secure Backup and impact additional products (scope change).
- CVE-2026-101479High
Vulnerability in Oracle Secure Backup (Backup and Restore component) versions 19.1.0.0.0 and 19.1.0.1.0. An easily exploitable TCP network attack by an unauthenticated attacker can cause a hang or frequently repeatable crash (complete DoS) of Oracle Secure Backup.
- CVE-2026-101484Critical
Vulnerability in Oracle Secure Backup (Backup and Restore component) affecting versions 19.1.0.0.0 and 19.1.0.1.0. An unauthenticated attacker with network access via TCP can easily compromise the system. CVSS 9.8.
Original NVD description (English source)
Vulnerability in Oracle Secure Backup (component: NDMP daemon). Supported versions that are affected are 19.1.0.0.0 and 19.1.0.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TCP to compromise Oracle Secure Backup. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Secure Backup accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).
Vulnerability data from NVD (NIST) · CISA KEV · EPSS