Autonomous Health Framework EUVD-2026-105901

Exploitation requires the attacker to already possess local logon access with low privileges on the infrastructure host where Oracle Autonomous Health Framework executes, specifically interacting with the Trace File Analyzer component; it cannot be triggered remotely or by an unauthenticated user (AV:L, PR:L). Affected deployments are AHF versions 26.3 through 26.8. The limiting factors are significant: an attacker must first gain a foothold on the host, so this is realistically a post-compromise or malicious-insider scenario rather than a remote threat. The elevated concern is the scope change - Oracle states successful attacks may significantly impact additional products on the host, so the confidentiality exposure can extend beyond AHF's own data.

This is a moderate-priority issue, not a top-tier emergency. The CVSS 3.1 base score of 6.5 is driven by a local attack vector (AV:L) requiring an attacker to already have logon access to the infrastructure where Oracle Autonomous Health Framework (AHF) runs, with low privileges (PR:L) and no user interaction (UI:N). The only impact is confidentiality (C:H, I:N, A:N) - there is no integrity or availability damage - but the scope change (S:C) is what elevates it, because Oracle explicitly states attacks 'may significantly impact additional products,' meaning disclosed data can extend beyond AHF itself. No EPSS score, KEV listing, or POC was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The combination of local-only access plus required low privileges substantially limits real-world risk: this is an insider or post-compromise privilege/data-exposure problem, not a remotely wormable flaw. Note a conflict worth verifying: the input Tags label this 'Authentication Bypass,' but the Oracle description describes a low-privileged local user reading unauthorized data via a scope change - that is a confidentiality disclosure, not an authentication bypass, so the tag appears mislabeled.

An attacker who already has a low-privileged local account on a server running Oracle Autonomous Health Framework abuses the Trace File Analyzer component to read sensitive data they should not be able to access. Because of the scope change, the disclosed data can include critical information belonging to other products on the same host, not just AHF. No public exploit code was identified, and exploitation requires pre-existing local logon access.