A vulnerability within the Trace File Analyzer component of Oracle Autonomous Health Framework permits an attacker who already has a low‑privileged logon to the infrastructure hosting the framework to compromise the framework itself and gain unauthorized access to data stored therein. The flaw enables a scope change, meaning that control of the framework can lead to the compromise of additional Oracle products that rely on the same data or infrastructure. The vulnerability is characterized by local availability, low attack complexity, low required privileges, no user interaction, and a potential for confidentiality impact only, which aligns with the CVSS 3.1 vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N.

The affected product is Oracle Autonomous Health Framework for all releases from 26.3 through 26.8. Oracle Autonomous Health Framework is the sole vendor/product affected in the disclosed CVE.

The CVSS base score of 6.5 categorizes this flaw as a medium‑severity vulnerability that could be exploited by an attacker with local access. Because the EPSS score is not available, the precise exploitation frequency is unknown, but the lack of entry into the CISA KEV catalog suggests no widespread, immediately available exploit code. Nevertheless, the capability for an attacker to move from low‑privileged local access to full, unauthorized data access warrants timely remediation. The instance of scope change increases the potential impact beyond the single component to other Oracle applications that depend on shared data.