Autonomous Health Framework CVE-2026-70728

Exploitation requires network access to the Oracle Autonomous Health Framework over HTTP and at minimum low-privileged credentials to the Trace File Analyzer component, consistent with the CVSS PR:L metric. No user interaction is required and attack complexity is low, meaning a network-authenticated attacker can exploit this without triggering additional user actions or relying on timing conditions. The scope change (S:C) indicates that successful exploitation can impact Oracle products beyond AHF itself within the same deployment. Exploitation is bounded by the low-privilege credential requirement - fully unauthenticated exploitation (PR:N) is not supported by the CVSS vector, though the 'Authentication Bypass' intelligence tag suggests the privilege threshold may be minimal or partially circumventable. No non-default configuration or special deployment mode is described as a prerequisite; the vulnerable code path appears present in the standard TFA HTTP interface across all listed 26.x versions.

The CVSS 3.1 base score of 8.5 reflects genuine severity: network-reachable (AV:N), low complexity (AC:L), low privilege required (PR:L), no user interaction (UI:N), with scope change (S:C) enabling impact on additional Oracle products beyond AHF. Confidentiality impact is rated High and Integrity Low, with no Availability impact. The 'Authentication Bypass' tag introduces a nuance: if exploitation only requires low-privilege credentials that are broadly issued or default in Oracle environments, practical exploitation effort may be lower than PR:L formally suggests. No EPSS data was provided in the intelligence feed, and this CVE is not currently listed in the CISA KEV catalog, meaning active exploitation has not been confirmed by U.S. government threat intelligence. No public proof-of-concept is known at time of analysis. Despite the absence of confirmed active exploitation, even a mid-sized municipal IT team in legnica managing Oracle Database infrastructure should treat this as urgent given the scope-change potential to adjacent Oracle products and the low attack complexity. The primary uncertainty is whether the low-privilege threshold reflects a dedicated Oracle AHF account or simply any authenticated HTTP session on the system.

An attacker holding a low-privileged account against the Oracle AHF Trace File Analyzer HTTP interface - obtained via credential theft, shared service accounts, or weak default credentials - sends a crafted HTTP request that bypasses authorization controls within TFA. This grants the attacker complete read access to all AHF-accessible data, including potentially sensitive diagnostic traces containing configuration details or operational credentials, as well as limited insert or update capability. Due to the scope change, the attacker may further leverage this foothold to affect adjacent Oracle products or services co-deployed in the same environment.