CVE-2026-70728

Analyzed Analyzed - Analysis Complete

Oracle Autonomous Health Framework Unauthorized Data Access

Publication date: 2026-08-18

Last updated on: 2026-08-26

Assigner: Oracle

Description

Vulnerability in Oracle Autonomous Health Framework (component: Trace File Analyzer). Supported versions that are affected are 26-26.1.0, 26.2.0, 26.3.1, 26.5.0 and 26.5.2. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Autonomous Health Framework. While the vulnerability is in Oracle Autonomous Health Framework, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Autonomous Health Framework accessible data as well as unauthorized update, insert or delete access to some of Oracle Autonomous Health Framework accessible data. CVSS 3.1 Base Score 8.5 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-18

Last Modified

2026-08-26

Generated

2026-09-08

AI Q&A

2026-08-19

EPSS Evaluated

2026-09-06

NVD

CVE-2026-70728

Affected Vendors & Products

Vendor	Product	Version / Range
oracle	autonomous_health_framework	26.2.0
oracle	autonomous_health_framework	From 26.0.0 (inc) to 26.1.0 (inc)
oracle	autonomous_health_framework	26.3.1
oracle	autonomous_health_framework	26.5.0
oracle	autonomous_health_framework	26.5.2

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-284	The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Attack-Flow Graph

Executive Summary

This is a vulnerability in Oracle Autonomous Health Framework, specifically in the Trace File Analyzer component. It affects versions 26-26.1.0, 26.2.0, 26.3.1, 26.5.0, and 26.5.2. The issue allows a low-privileged attacker with network access via HTTP to exploit it and compromise the framework.

Detection Guidance

Detection requires checking for Oracle Autonomous Health Framework versions 26-26.1.0, 26.2.0, 26.3.1, 26.5.0, or 26.5.2. Verify installed versions via Oracle documentation or system logs. Monitor network traffic for HTTP access to the framework. Check for unauthorized data access or modifications in logs.

Impact Analysis

An attacker could gain unauthorized access to critical data or all data accessible by Oracle Autonomous Health Framework. They could also perform unauthorized updates, inserts, or deletes on some of this data. The impact includes confidentiality and integrity breaches.

Compliance Impact

This vulnerability allows unauthorized access to critical data or complete access to all Oracle Autonomous Health Framework accessible data, which could lead to unauthorized data exposure or modification. Such breaches may violate compliance requirements under GDPR, HIPAA, or other regulations depending on the data involved.

Mitigation Strategies

Apply the latest security patches from Oracle for the affected versions of Autonomous Health Framework (26-26.1.0, 26.2.0, 26.3.1, 26.5.0, 26.5.2). Restrict network access to HTTP interfaces of the framework to trusted sources only. Review and update user privileges to ensure least privilege access for all accounts.

Hi! I’m here to help you understand CVE-2026-70728. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70