EUVD-2026-46578
GHSA-hcv3-w4cp-jxwp
Severity by source
AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H
Local-only vector, high privileges pre-required, high complexity, and user interaction all confirmed by Oracle's description; full CIA impact reflects stated 'takeover' outcome.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
Lifecycle Timeline
1DescriptionCVE.org
Vulnerability in Oracle Autonomous Health Framework (component: Developer triaging platform). Supported versions that are affected are 26.0.0, 26.1.0 and 26.2.0. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where Oracle Autonomous Health Framework executes to compromise Oracle Autonomous Health Framework. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle Autonomous Health Framework. CVSS 3.1 Base Score 6.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H).
AnalysisAI
Full takeover of Oracle Autonomous Health Framework is achievable by a highly privileged local attacker under difficult exploitation conditions in versions 26.0.0 through 26.2.0, specifically within the Developer triaging platform component. Successful exploitation requires both high infrastructure privileges and active human interaction from a separate user, making opportunistic attacks unlikely. No public exploit code or CISA KEV listing has been identified; this vulnerability appears to be a low-frequency, targeted risk rather than a widespread exploitation concern.
Technical ContextAI
Oracle Autonomous Health Framework (AHF) is Oracle's integrated diagnostic and health-monitoring platform, used to collect and analyze diagnostic data across Oracle Database and Exadata environments. The vulnerable component is the Developer triaging platform subcomponent, which likely handles log collection, trace analysis, or developer-facing diagnostic workflows. The CPE string (cpe:2.3:a:oracle_corporation:oracle_autonomous_health_framework:*:*:*:*:*:*:*:*) covers the application tier. No CWE is provided, so the root-cause vulnerability class cannot be formally identified; however, the CVSS vector (AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H) and the 'takeover' impact language suggest a privilege escalation or insecure file/process interaction pattern - possibly a race condition, symlink attack, or unsafe temporary file handling - that requires high-privilege context to reach but can then fully compromise the AHF process. The 'Information Disclosure' tag in the intelligence sources is inconsistent with the full C:H/I:H/A:H impact; this may reflect the original report category or a secondary impact path rather than the primary impact.
RemediationAI
Apply the patch released in Oracle's Critical Patch Update for July 2026, referenced at https://www.oracle.com/security-alerts/cpujul2026.html. Oracle has not published an exact fixed version number in the available intelligence data - contact Oracle support or consult the full CPU document to confirm the target patch version for AHF 26.x. Until patching is complete, reduce risk by restricting local infrastructure access to AHF hosts to the minimum set of privileged accounts required for operations; revoke developer or non-essential admin accounts from the infrastructure tier. Segregate AHF hosts from shared administrative jump boxes to reduce the attacker population that can satisfy the PR:H and AV:L requirements. Because UI:R is a requirement, alerting on unusual interactive sessions or developer triaging platform activity during non-standard hours may help detect exploitation attempts. No patch-free workaround has been confirmed; the above controls reduce attack surface but do not eliminate the vulnerability.
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today