CVE-2026-101480

Awaiting Analysis Awaiting Analysis - Queue

Oracle Secure Backup NDMP Daemon Information Disclosure

Publication date: 2026-10-20

Last updated on: 2026-11-06

Assigner: Oracle

Description

Vulnerability in Oracle Secure Backup (component: NDMP daemon). Supported versions that are affected are 19.1.0.0.0 and 19.1.0.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TCP to compromise Oracle Secure Backup. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Secure Backup accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-20

Last Modified

2026-11-06

Generated

2026-11-10

AI Q&A

2026-10-21

EPSS Evaluated

2026-11-08

NVD

CVE-2026-101480

EUVD

EUVD-2026-105896

Affected Vendors & Products

Vendor	Product	Version / Range
Oracle Corporation	Oracle Secure Backup	19.1.0.0.0
Oracle Corporation	Oracle Secure Backup	19.1.0.1.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-200	The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

Executive Summary

This is a vulnerability in Oracle Secure Backup versions 19.1.0.0.0 and 19.1.0.1.0. It allows an unauthenticated attacker with network access to read some data stored in Oracle Secure Backup without needing to log in.

Detection Guidance

This vulnerability affects Oracle Secure Backup versions 19.1.0.0.0 and 19.1.0.1.0. To detect it, check if the NDMP daemon is running on TCP ports typically used by Oracle Secure Backup (e.g., port 10000). Use commands like 'netstat -tulnp | grep 10000' or 'ss -tulnp | grep 10000' to identify listening services. Verify the installed version with 'obtool --version' or check package managers like 'rpm -qa | grep oracle-secure-backup'.

Impact Analysis

An attacker could access sensitive data stored in Oracle Secure Backup, potentially leading to unauthorized information disclosure. The impact is limited to reading data and does not allow modification or deletion.

Compliance Impact

This vulnerability could lead to non-compliance with data protection regulations like GDPR or HIPAA by allowing unauthorized access to sensitive data. Organizations using affected versions must address it to maintain compliance.

Mitigation Strategies

Apply the latest security patches from Oracle for Oracle Secure Backup versions 19.1.0.0.0 and 19.1.0.1.0. Restrict network access to the NDMP daemon by blocking TCP ports used by Oracle Secure Backup at the firewall level. Monitor network traffic for unauthorized access attempts to the NDMP daemon.

Hi! I’m here to help you understand CVE-2026-101480. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...