CVE-2026-101484 is a critical (CVSS 9.8) flaw in the Backup and Restore component of Oracle Secure Backup that lets an unauthenticated attacker with TCP network access take over affected installations.
What Is It
CVE-2026-101484 is a vulnerability in Oracle Secure Backup, in the Backup and Restore component. Oracle, the reporting source, describes it as "easily exploitable." An attacker needs only network access over TCP to compromise the product. They do not need to authenticate first. NVD published the record on October 20, 2026, and its status is currently "Received."
The CVSS 3.1 vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Confidentiality / Integrity / Availability: High / High / High
The record gives an exploitability subscore of 3.9 and an impact subscore of 5.9.
Why It Matters
According to Oracle, a successful attack can result in full takeover of Oracle Secure Backup. That means a high impact on confidentiality, integrity and availability. An attacker needs no credentials, no user interaction and no complex conditions, so any affected instance reachable over the network is exposed. Backup infrastructure often has broad access to the data it protects, so compromising it is a serious risk.
As of this writing, CVE-2026-101484 is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The supplied sources do not confirm active exploitation, and CISA has not set a required action or due date.
What's Vulnerable
- Vendor: Oracle Corporation
- Product: Oracle Secure Backup
- Component: Backup and Restore
- Affected supported versions:
- 19.1.0.0.0
- 19.1.0.1.0
The NVD record does not yet list any CPE entries.
Patch Status
The NVD record links to Oracle's October 2026 Critical Patch Update (CPU) advisory as its reference. Organizations running Oracle Secure Backup 19.1.0.0.0 or 19.1.0.1.0 should check that advisory for fixed versions and remediation guidance, and apply Oracle's fix. Because the flaw is network-reachable and needs no authentication, limiting TCP access to Oracle Secure Backup services should be a priority until patching is complete.
Sources
- Oracle Critical Patch Update Advisory – October 2026
- NVD – CVE-2026-101484
- CISA Known Exploited Vulnerabilities Catalog (not listed as of publication)