CVE-2026-60172

Analyzed Analyzed - Analysis Complete

Privilege Escalation in Oracle Autonomous Health Framework

Publication date: 2026-07-21

Last updated on: 2026-08-06

Assigner: Oracle

Description

Vulnerability in Oracle Autonomous Health Framework (component: Developer triaging platform). Supported versions that are affected are 26.0.0, 26.1.0 and 26.2.0. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where Oracle Autonomous Health Framework executes to compromise Oracle Autonomous Health Framework. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle Autonomous Health Framework. CVSS 3.1 Base Score 6.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-21

Last Modified

2026-08-06

Generated

2026-08-11

AI Q&A

2026-07-22

EPSS Evaluated

2026-08-09

NVD

CVE-2026-60172

EUVD

EUVD-2026-46578

Affected Vendors & Products

Vendor	Product	Version / Range
oracle	autonomous_health_framework	26.0.0
oracle	autonomous_health_framework	26.1.0
oracle	autonomous_health_framework	26.2.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-284	The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Attack-Flow Graph

Executive Summary

This is a vulnerability in Oracle Autonomous Health Framework versions 26.0.0, 26.1.0, and 26.2.0. It allows a high-privileged attacker with local access to compromise the framework. Exploitation requires human interaction from another person and can lead to full takeover of the framework. The attack complexity is high, and it has significant impacts on confidentiality, integrity, and availability.

Detection Guidance

Detection requires checking for Oracle Autonomous Health Framework versions 26.0.0, 26.1.0, or 26.2.0. Verify installed versions using Oracle's tools or package managers. No specific commands are provided in the context.

Impact Analysis

If you use Oracle Autonomous Health Framework versions 26.0.0, 26.1.0, or 26.2.0, an attacker with local access and high privileges could take over the framework. This could lead to unauthorized access, data breaches, or system manipulation. Human interaction from another person is required for the attack to succeed.

Compliance Impact

This vulnerability could lead to unauthorized access or data breaches, which may violate compliance requirements under GDPR, HIPAA, or other regulations. Organizations using affected versions should address this vulnerability to maintain compliance and protect sensitive data.

Mitigation Strategies

Apply Oracle's official patches or updates for the affected versions. Restrict user privileges to reduce attack surface. Monitor logs for suspicious activity related to the framework.

Hi! I’m here to help you understand CVE-2026-60172. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70