The Oracle Autonomous Health Framework Trace File Analyzer component has a flaw that enables a local low‑privileged user to gain control of the framework. The flaw arises from improper input validation and insufficient access control, as reflected by the associated CWEs. Exploitation results in full compromise of the framework, affecting confidentiality, integrity, and availability with high severity.

Affected versions are Oracle Autonomous Health Framework 26.3 through 26.8, specifically the releases that include the Trace File Analyzer component. Administrators should verify if their deployed instance matches any of these releases.

The CVSS 3.1 base score of 7.8 shows a high likelihood of successful compromise when a low‑privilege account logs on to the host. The EPSS score of less than 1% indicates a low probability of exploitation in the wider public. The vulnerability is not listed in the CISA KEV catalog. Based on the limited information in the description, the attack vector is local; only a low‑privileged login at the infrastructure where the framework runs is required, and no network access is needed. The effect on confidentiality, integrity, and availability is full when the framework is compromised.