What is the CVSS score of CVE-2026-70715?

CVE-2026-70715 has a CVSS 3.1 base score of 6.8 (Medium). CVSS vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Trace File Analyzer are affected by CVE-2026-70715?

Oracle Autonomous Health Framework versions 26.x contain a high-severity vulnerability in the Trace File Analyzer component that enables unauthenticated attackers with network access to achieve…

How to fix or mitigate CVE-2026-70715?

Within 24 hours: discover and document all systems running Oracle Autonomous Health Framework versions 26.0 through 26.5.2, including 26.1.0, 26.2.0, 26.3.1, and 26.5.0; implement network segmentation to restrict Trace File Analyzer communication to trusted administrative networks only. Within 7 days: deploy host-based access controls, configure network-level monitoring on TFA communication ports, and maintain an inventory of affected systems with isolation status. Within 30 days: monitor Oracle security advisories for available patches on affected 26.x branches; contact Oracle support for remediation timeline and patch ETA; and develop a phased migration plan to patched versions once available.

Trace File Analyzer CVE-2026-70715

EUVD-2026-61670 MEDIUM

Improper Access Control (CWE-284)

2026-08-18 secalert_us@oracle.com

GHSA-w6f5-983v-f78f

Authentication Bypass Oracle Autonomous Health Framework

6.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.8 MEDIUM

AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

AV:A confirmed by segment-access requirement; PR:N and full CIA:H align with unauthenticated full-takeover described by Oracle.

3.1 AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Physical

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Severity Changed

Aug 26, 2026 - 20:23 NVD

HIGH MEDIUM

CVSS changed

Aug 26, 2026 - 20:23 NVD

8.8 (HIGH) 6.8 (MEDIUM)

Analysis Generated

Aug 19, 2026 - 00:28 vuln.today

CVE Published

Aug 18, 2026 - 21:17 nvd

HIGH 8.8

DescriptionNVD

Vulnerability in Oracle Autonomous Health Framework (component: Trace File Analyzer). Supported versions that are affected are 26-26.1.0, 26.2.0, 26.3.1, 26.5.0 and 26.5.2. Easily exploitable vulnerability allows unauthenticated attacker with access to the physical communication segment attached to the hardware where the Oracle Autonomous Health Framework executes to compromise Oracle Autonomous Health Framework. Successful attacks of this vulnerability can result in takeover of Oracle Autonomous Health Framework. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Full takeover of Oracle Autonomous Health Framework is achievable by an unauthenticated attacker positioned on the same physical or logical network segment as the affected host, exploiting a flaw in the Trace File Analyzer (TFA) component. Affected releases span multiple 26.x branches - 26 through 26.1.0, 26.2.0, 26.3.1, 26.5.0, and 26.5.2 - with successful exploitation yielding complete confidentiality, integrity, and availability compromise. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	The mandatory prerequisite is physical or logical network adjacency to the host running Oracle Autonomous Health Framework - the attacker must be on the same LAN segment, VLAN, or cluster interconnect network as the AHF host; internet-based or fully remote exploitation is not possible per the AV:A CVSS metric. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 3.1 score of 8.8 (High) is appropriately driven by the full CIA:H impact and absence of required authentication, but the AV:A vector meaningfully constrains the attacker pool to those with physical or logical adjacency - a significant real-world limiter compared to AV:N vulnerabilities. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	Apply Oracle's Critical Patch Update for August 2026 via the advisory at https://www.oracle.com/security-alerts/cspuaug2026.html, which is the vendor-confirmed source addressing this vulnerability. … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours: discover and document all systems running Oracle Autonomous Health Framework versions 26.0 through 26.5.2, including 26.1.0, 26.2.0, 26.3.1, and 26.5.0; implement network segmentation to restrict Trace File Analyzer communication to trusted administrative networks only. …

Threat intelligence, references, and detailed analysis are available after sign-in.