EUVD-2026-105894
GHSA-92v6-m9q7-qfgf
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privilege host logon
-
DeliveryInteract with Trace File Analyzer component
-
ExploitAbuse flaw in AHF processing
-
ExecutionExecute with elevated privileges
-
ImpactFull takeover of AHF
Vulnerability Assessment
| Exploitation Conditions | Exploitation requires the attacker to already possess an authenticated low-privileged logon (PR:L) on the infrastructure host where Oracle Autonomous Health Framework and its Trace File Analyzer component execute; it cannot be triggered remotely or by an unauthenticated user (AV:L). No user interaction is needed (UI:N) and attack complexity is low (AC:L). Affected deployments are Oracle Autonomous Health Framework versions 26.3 through 26.8. The limiting factor is the local-access prerequisite: a defender with strong host access controls and least-privilege OS accounts materially reduces who can reach this flaw. |
| Impact | This is a genuine but access-gated priority. The provided CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.8 HIGH) is internally consistent: local vector, low complexity, low privileges required, no user interaction, with full Confidentiality/Integrity/Availability compromise resulting in takeover of the framework. The key risk-limiting factor is AV:L - an attacker must already have authenticated low-privilege logon to the host where Oracle Autonomous Health Framework runs, so this is a privilege-escalation/lateral-movement class issue rather than a remotely exploitable one. No EPSS score, no CISA KEV listing, and no POC were provided in the input, so there is no public exploitation signal: no public exploit identified at time of analysis. SSVC framing is inferable rather than provided - exploitation=none observed, automatable=no (requires local authenticated access), technical impact=total. Net: real and worth patching in the next Oracle CPU cycle, but the local-access precondition and absence of exploitation evidence place it below internet-facing critical bugs for prioritization. |
| Exploit ScenarioDerived | An attacker who already holds a low-privileged OS account on a host running Oracle Autonomous Health Framework abuses the Trace File Analyzer component - which typically runs with elevated privileges - to escalate and fully compromise the framework. Because the CVSS vector is local (AV:L) with low complexity and no user interaction, the action requires only an existing foothold such as a compromised application or database service account. No public exploit code is identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Local privilege escalation in Oracle Autonomous Health Framework 26.3 through 26.8 allows an authenticated, low-privileged user with a logon on the AHF host to take over the product's Trace File Analyzer component, with high confidentiality, integrity, and availability impact (CVSS 3.1 base 7.8). The flaw cannot be reached remotely or without credentials: exploitation depends entirely on the attacker already holding a local account on the infrastructure where AHF executes, so least-privilege OS accounts and tight host access control directly shrink the exposed population. No public exploit code or confirmed active exploitation was identified at time of analysis, and no EPSS score was supplied; the Oracle advisory is the authoritative remediation source.
RemediationAI
Patch available per vendor advisory: apply the October 2026 Oracle Critical Patch Update for Autonomous Health Framework (https://www.oracle.com/security-alerts/cpuoct2026.html), which is the only authoritative source for the exact fixed AHF build; no specific patched version number was included in the supplied data, so confirm the target release in the CPU before upgrading. In the interim, the highest-value compensating control is reducing who can satisfy the PR:L prerequisite: remove unnecessary local accounts and shell access on AHF-bearing hosts, and restrict sudo/powerbroker rights to the tfactl and AHF command set so that ordinary users cannot invoke the diagnostic tooling at elevated privilege (trade-off: narrows routine DBA and support workflows and may slow log collection during incidents). Harden filesystem ownership and permissions on the AHF installation and TFA output/repository directories so a low-privileged user cannot pre-create, replace, or symlink objects the privileged collector later touches (trade-off: must be re-applied after upgrades, which reset ownership). Where AHF is not actively needed on a host, deinstall or disable it to remove the attack surface entirely. Monitor host audit logs for unexpected tfactl executions and for file creation in AHF directories by non-privileged accounts.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Trace File Analyzer (TFA) is the diagnostic collection subsystem bundled with Oracle Autonomous Health Framework, the tooling Oracle ships on database and Exadata hosts to gather logs and traces from the OS and database stack, typically executing with privileges above those of the account that invokes it. No CWE was assigned in the source data; the CVSS vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H describes a local-only, low-complexity, no-interaction attack in which a low-privileged local user crosses a privilege boundary inside the same security scope (S:U) to gain full control of the component - the classic shape of an insecure privilege-handling or file/command-handling weakness in a root-installed diagnostic utility. Because the vector is PR:L, authentication is a hard prerequisite rather than an obstacle the attacker must overcome remotely. No CPE identifiers or product-specific CWEs were included in the supplied intelligence, so the affected surface should be scoped by installed AHF version rather than by CPE matching.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Description states a low-privileged attacker with host logon (AV:L, PR:L) achieves takeover with no user interaction, yielding full C/I/A impact.
Primary rating from NVD.
CVSS VectorNVD
DescriptionNVD
Vulnerability in Oracle Autonomous Health Framework (component: Trace File Analyzer). Supported versions that are affected are 26.3-26.8. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Autonomous Health Framework executes to compromise Oracle Autonomous Health Framework. Successful attacks of this vulnerability can result in takeover of Oracle Autonomous Health Framework. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
Executive ViewAI
Oracle Autonomous Health Framework 26.3 through 26.8 contains a high-severity local privilege escalation flaw that lets an existing low-privilege user on the AHF host take over the Trace File Analyzer component, with high confidentiality, integrity, and availability impact. Exposure is limited to hosts where an attacker already holds a local account, so the practical business risk is concentrated in environments with broad local access to critical infrastructure. No public exploit identified at time of analysis, and no vendor-released patch identified at time of analysis.
No vendor-released patch identified at time of analysis; restrict local logon to AHF hosts to least-privilege accounts, remove unnecessary local users, enforce host access controls, monitor and audit Trace File Analyzer activity, and follow Oracle advisory guidance for interim mitigations.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB