CVE-2026-70734

Vulnerability in Oracle Autonomous Health Framework (component: Trace File Analyzer). Supported versions that are affected are 26-26.1.0, 26.2.0, 26.3.1, 26.5.0 and 26.5.2. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle Autonomous Health Framework executes to compromise Oracle Autonomous Health Framework. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Autonomous Health Framework, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Autonomous Health Framework accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Autonomous Health Framework. CVSS 3.1 Base Score 7.4 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:C/C:N/I:H/A:H).

CVSS v3 7.4 HIGH

7.4^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.1 / Impact : 5.8

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required HIGH

User Interaction REQUIRED

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

References

Link	Resource
https://www.oracle.com/security-alerts/cspuaug2026.html	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:oracle:autonomous_health_framework::::::::
	cpe:2.3:a:oracle:autonomous_health_framework:26.2.0:::::::*
	cpe:2.3:a:oracle:autonomous_health_framework:26.3.1:::::::*
	cpe:2.3:a:oracle:autonomous_health_framework:26.5.0:::::::*
	cpe:2.3:a:oracle:autonomous_health_framework:26.5.2:::::::*

History

No history.

Information

Published : 2026-08-18 21:17

Updated : 2026-08-26 20:17

NVD link : CVE-2026-70734

Mitre link : CVE-2026-70734

CVE.ORG link : CVE-2026-70734

JSON object : View

Products Affected

oracle

autonomous_health_framework

CWE

CWE-284

Improper Access Control

{"id": "CVE-2026-70734", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-70734", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-25T15:00:42.952060Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "secalert_us@oracle.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 7.4, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:C/C:N/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "NONE"}, "impactScore": 5.8, "exploitabilityScore": 1.1}]}, "affected": [{"source": "secalert_us@oracle.com", "affectedData": [{"vendor": "Oracle Corporation", "product": "Oracle Autonomous Health Framework", "versions": [{"status": "affected", "version": "26", "versionType": "custom", "lessThanOrEqual": "26.1.0"}, {"status": "affected", "version": "26.2.0", "versionType": "semver"}, {"status": "affected", "version": "26.3.1", "versionType": "semver"}, {"status": "affected", "version": "26.5.0", "versionType": "semver"}, {"status": "affected", "version": "26.5.2", "versionType": "semver"}]}]}], "published": "2026-08-18T21:17:26.087", "references": [{"url": "https://www.oracle.com/security-alerts/cspuaug2026.html", "tags": ["Vendor Advisory"], "source": "secalert_us@oracle.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-284"}]}], "descriptions": [{"lang": "en", "value": "Vulnerability in Oracle Autonomous Health Framework (component: Trace File Analyzer). Supported versions that are affected are 26-26.1.0, 26.2.0, 26.3.1, 26.5.0 and 26.5.2. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle Autonomous Health Framework executes to compromise Oracle Autonomous Health Framework. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Autonomous Health Framework, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Autonomous Health Framework accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Autonomous Health Framework. CVSS 3.1 Base Score 7.4 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:C/C:N/I:H/A:H)."}], "lastModified": "2026-08-26T20:17:36.590", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:oracle:autonomous_health_framework:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D7D081AC-A127-4564-8C9B-1C0BD844E7F7", "versionEndIncluding": "26.1.0", "versionStartIncluding": "26.0.0"}, {"criteria": "cpe:2.3:a:oracle:autonomous_health_framework:26.2.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "471170FE-118C-4D4E-AD3D-5A23F9FA9CAE"}, {"criteria": "cpe:2.3:a:oracle:autonomous_health_framework:26.3.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4B5EF425-C9EB-443C-BF39-FB2750B5EABC"}, {"criteria": "cpe:2.3:a:oracle:autonomous_health_framework:26.5.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8B4C43E8-2B34-4A1E-ADED-A3DB20A9917B"}, {"criteria": "cpe:2.3:a:oracle:autonomous_health_framework:26.5.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9C94B05D-4E5A-4560-ACF0-7F167951F8E8"}], "operator": "OR"}]}], "sourceIdentifier": "secalert_us@oracle.com"}