CVE-2026-101485

Awaiting Analysis Awaiting Analysis - Queue

Privilege Escalation in Oracle Autonomous Health Framework

Publication date: 2026-10-20

Last updated on: 2026-11-08

Assigner: Oracle

Description

Vulnerability in Oracle Autonomous Health Framework (component: Trace File Analyzer). Supported versions that are affected are 26.3-26.8. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Autonomous Health Framework executes to compromise Oracle Autonomous Health Framework. While the vulnerability is in Oracle Autonomous Health Framework, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Autonomous Health Framework accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-20

Last Modified

2026-11-08

Generated

2026-11-10

AI Q&A

2026-10-21

EPSS Evaluated

2026-11-08

NVD

CVE-2026-101485

EUVD

EUVD-2026-105901

Affected Vendors & Products

Vendor	Product	Version / Range
Oracle Corporation	Oracle Autonomous Health Framework	26.3

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-284	The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Attack-Flow Graph

Executive Summary

This is a vulnerability in Oracle Autonomous Health Framework (component: Trace File Analyzer) affecting versions 26.3-26.8. It allows a low-privileged attacker with logon access to compromise the framework and potentially impact other products. Successful exploitation can lead to unauthorized access to critical data or full access to all data accessible by the framework.

Detection Guidance

Detection of this vulnerability requires checking for vulnerable versions of Oracle Autonomous Health Framework (26.3-26.8). Inspect installed packages or directories related to the framework. No specific commands are provided in the context.

Impact Analysis

If you use Oracle Autonomous Health Framework versions 26.3-26.8, an attacker with local access could exploit this to steal sensitive data or gain full control over the framework. This may expose confidential information or disrupt operations depending on the framework's role in your environment.

Compliance Impact

This vulnerability could lead to unauthorized data access, violating GDPR (data protection) and HIPAA (health data privacy). Non-compliance risks include fines, legal penalties, and reputational damage due to exposed sensitive information.

Mitigation Strategies

Apply the latest security patches from Oracle for Oracle Autonomous Health Framework versions 26.3-26.8. Restrict logon access to the infrastructure where this framework executes to only authorized users. Monitor for unauthorized access attempts or unusual activity in the framework's logs.

Hi! I’m here to help you understand CVE-2026-101485. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...