Oracle AHF EUVD-2026-105868

Exploitation requires an interactive local logon to the host/infrastructure where Oracle Autonomous Health Framework executes, using a low-privileged account (PR:L) - it is NOT remotely exploitable over a network. The specific attack surface is the AHF Instant Diagnostic Replay component on affected AHF versions 26.3 through 26.8. No user interaction and no special non-default configuration are stated as required (Oracle rates it easily exploitable), but the mandatory pre-existing local account and host access are the primary limiting factors that keep real-world risk below the raw 7.8 score; hosts without exposure of local accounts to untrusted parties are substantially less at risk.

This is a moderate-priority local privilege/takeover vulnerability rather than a mass-exploitation threat. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8) confirms it requires local logon access and low-level privileges, which fundamentally limits blast radius: an attacker must already have a foothold on the host where Oracle Autonomous Health Framework runs. Offsetting the local-access constraint, attack complexity is low and no user interaction is needed, and Oracle explicitly characterizes it as 'easily exploitable' with full confidentiality, integrity, and availability compromise (complete takeover of AHF). No EPSS score, CISA KEV listing, or public POC is present in the provided data, so there is no public exploit identified at time of analysis and no evidence of active or automatable exploitation. Net: a genuine post-foothold escalation/takeover risk worth patching on Oracle DB/Grid Infrastructure hosts, but not an internet-facing emergency. Note a minor signal conflict: the input Tag 'Information Disclosure' understates the actual impact, which the description and CVSS (I:H/A:H) show to be full takeover, not disclosure alone.

An attacker who already has a low-privileged local account on a server running Oracle Autonomous Health Framework (e.g., a limited OS user on an Oracle Database/Grid Infrastructure host) targets the AHF Instant Diagnostic Replay component to escalate to full control of AHF. Because attack complexity is low and no user interaction is required, the action can be scripted once local access is obtained, yielding confidentiality, integrity, and availability compromise. No public exploit code is identified at time of analysis.