The vulnerability exists in the Trace File Analyzer component of Oracle Autonomous Health Framework, allowing an unauthenticated attacker who has physical access to the hardware communication segment to trigger the flaw. Exploitation results in full takeover of the framework, compromising confidentiality, integrity and availability. The flaw is described as easily exploitable and carries a CVSS 3.1 base score of 8.8 indicating high severity.

Affecting Oracle Corporation's Oracle Autonomous Health Framework product, the vulnerable releases are 26–26.1.0, 26.2.0, 26.3.1, 26.5.0 and 26.5.2. Any installation of these versions remains susceptible until a patch is applied.

The CVSS vector (AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) shows the flaw can be abused from a local physical segment with no credentials or user interaction. The EPSS score is < 1 % indicating a very low but non‑zero probability of exploitation, while the issue is not listed in KEV. The high CVSS score and easy exploitation suggest a high impact if an attacker with physical access succeeds, but the low EPSS indicates that public exploitation risk remains limited at this time. The absence of an authentication requirement raises concern for insider or supply‑chain threat actors.