Oracle Autonomous Health Framework contains a flaw in the Trace File Analyzer component that permits a low privileged attacker who has logged onto the infrastructure where the framework runs to compromise the application. The vulnerability enables the attacker to create, delete, or modify critical data and to trigger a hang or frequent crash, resulting in integrity and availability violations. The weakness is a classic missing authorization flaw, evidenced by the CVSS vector indicating local attack, low complexity, low privilege and without user interaction, and a scope change that could affect other Oracle products.

Affected installations are Oracle Autonomous Health Framework versions 26 through 26.1.0, 26.2.0, 26.3.1, 26.5.0, and 26.5.2. Users running these releases should verify their deployment and consult the Oracle security alert for patch availability.

With a CVSS base score of 8.4 the vulnerability is considered high severity. The EPSS score of < 1% indicates a very low probability of exploitation, and the absence of a listing in the CISA KEV catalog suggests no confirmed exploits yet. However, the low privileged local access requirement means that any user who can log into the underlying infrastructure is a potential attacker. The vulnerability’s impact on integrity and availability, combined with the scope change, makes it a significant risk for organizations relying on this framework.