CVE-2009-1977: Oracle Secure Backup authentication bypass and unspecified remote compromise

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: medium.

critical priorityCVSS 2.0 score of 10 with network reachability, no authentication, and full confidentiality, integrity, and availability impact, plus a very high EPSS percentile, warrants critical handling despite thin technical detail.

What it is

Oracle Secure Backup 10.2.0.3 contains an unspecified vulnerability that remote attackers can use to affect confidentiality, integrity, and availability. Oracle's advisory gives no technical detail, and an independent researcher claims the flaw allows authentication bypass through the username parameter and login.php, which Oracle has not confirmed.

Impact

An unauthenticated remote attacker could bypass authentication and gain full control over the affected component, compromising confidentiality, integrity, and availability.

Attack surface

The CVSS vector AV:N/AC:L/Au:N/C:C/I:C/A:C indicates the flaw is reachable over the network with no authentication and no user interaction. The researcher's claim points to the login.php endpoint and username parameter, but Oracle has not confirmed this path.

Exploitation

The record is not listed in CISA KEV and no reference carries an exploit tag, though EPSS gives a 30-day probability of 0.72638 (99.4th percentile), suggesting high predicted exploitation activity. No public exploit or in-the-wild use is documented in this record.

What to do

• Apply the Oracle July 2009 Critical Patch Update for Secure Backup 10.2.0.3 or upgrade to a supported release.
• Restrict network access to Secure Backup management and login interfaces to trusted hosts only.
• Monitor and audit authentication attempts against login.php and the username parameter for anomalies.
• If the product is end-of-life or cannot be patched, isolate it from untrusted networks or retire it.

Detection

• Review Secure Backup and web server logs for login.php requests with unusual or malformed username values.
• Alert on successful authentications from unexpected source IPs or outside normal administrative windows.
• Baseline normal Secure Backup traffic and flag deviations in request volume or parameter patterns to login endpoints.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.