CVE-2026-70715

Analyzed Analyzed - Analysis Complete

Remote Code Execution in Oracle Autonomous Health Framework

Publication date: 2026-08-18

Last updated on: 2026-08-26

Assigner: Oracle

Description

Vulnerability in Oracle Autonomous Health Framework (component: Trace File Analyzer). Supported versions that are affected are 26-26.1.0, 26.2.0, 26.3.1, 26.5.0 and 26.5.2. Easily exploitable vulnerability allows unauthenticated attacker with access to the physical communication segment attached to the hardware where the Oracle Autonomous Health Framework executes to compromise Oracle Autonomous Health Framework. Successful attacks of this vulnerability can result in takeover of Oracle Autonomous Health Framework. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-18

Last Modified

2026-08-26

Generated

2026-09-08

AI Q&A

2026-08-19

EPSS Evaluated

2026-09-06

NVD

CVE-2026-70715

Affected Vendors & Products

Vendor	Product	Version / Range
oracle	autonomous_health_framework	26.2.0
oracle	autonomous_health_framework	From 26.0.0 (inc) to 26.1.0 (inc)
oracle	autonomous_health_framework	26.3.1
oracle	autonomous_health_framework	26.5.0
oracle	autonomous_health_framework	26.5.2

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-284	The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Attack-Flow Graph

Executive Summary

This is a vulnerability in Oracle Autonomous Health Framework's Trace File Analyzer component affecting versions 26-26.1.0, 26.2.0, 26.3.1, 26.5.0 and 26.5.2. It allows an unauthenticated attacker with physical network access to take over the framework due to insufficient access controls.

Detection Guidance

Detection requires identifying Oracle Autonomous Health Framework versions 26-26.1.0, 26.2.0, 26.3.1, 26.5.0, or 26.5.2 on affected systems. Check installed software versions using system package managers or Oracle-specific tools. Verify network segments for unauthorized physical access to hardware running the framework.

Impact Analysis

An attacker could gain full control of the Oracle Autonomous Health Framework, potentially accessing sensitive data, disrupting operations, or using it as a foothold to compromise other systems in the environment.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating confidentiality requirements in GDPR and HIPAA. Organizations may face compliance violations, fines, or legal consequences if exploited.

Mitigation Strategies

Apply vendor patches or updates immediately. Isolate the Oracle Autonomous Health Framework system from untrusted networks. Restrict physical access to hardware. Monitor for suspicious activity. Consider disabling the component if not essential.

Hi! I’m here to help you understand CVE-2026-70715. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70