{"id":"CVE-2026-101452","kind":"vulnerability","aliases":["CVE-2026-101452"],"related":[],"title":"Oracle Autonomous Health Framework: local low-privilege users can take over the tool","description":"Vulnerability in Oracle Autonomous Health Framework (component: AHF Instant Diagnostic Replay).  Supported versions that are affected are 26.3-26.8. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Autonomous Health Framework executes to compromise Oracle Autonomous Health Framework.  Successful attacks of this vulnerability can result in takeover of Oracle Autonomous Health Framework. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).","summary":"Oracle Autonomous Health Framework's AHF Instant Diagnostic Replay component has a flaw that lets a low-privileged user who can log on to the host take it over. Successful exploitation gives the attacker full control of the framework, with high impact to confidentiality, integrity and availability.","severity":"high","cvss":7.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["autonomous-health-framework","linux","on-prem","oracle","oracle-database","other"],"not_affected_if":["no-ahf-installed","no-shared-host-logons"],"how_to_check":"- Check the installed AHF version against the affected range (26.3 to 26.8) with the AHF tooling on the host, for example `ahfctl version` (unknown if the sources give the exact command)\n- Confirm whether AHF is installed on hosts where local users have shell access","fix":"- Move AHF to a version later than `26.8` once Oracle publishes the fixed release (unknown: the sources do not name the fixed version)\n- Restrict shell logons on hosts running AHF to trusted administrators until patched","status":"open","published_at":"2026-10-20T22:17:53+00:00","first_seen_at":"2026-10-23T21:57:21+00:00","triaged_at":"2026-10-25T03:10:07+00:00","updated_at":"2026-10-25T03:10:07+00:00","category":"other","confidence":0.7,"triage":{"at":"2026-10-25T03:10:07Z","model":"claude-haiku-5-5","output":{"fix":"- Move AHF to a version later than `26.8` once Oracle publishes the fixed release (unknown: the sources do not name the fixed version)\n- Restrict shell logons on hosts running AHF to trusted administrators until patched","reach":"local","title":"Oracle Autonomous Health Framework: local low-privilege users can take over the tool","impact":"high","summary":"Oracle Autonomous Health Framework's AHF Instant Diagnostic Replay component has a flaw that lets a low-privileged user who can log on to the host take it over. Successful exploitation gives the attacker full control of the framework, with high impact to confidentiality, integrity and availability.","category":"other","nicknames":[],"who_cares":["oracle","oracle-database","autonomous-health-framework","linux","on-prem"],"confidence":0.7,"needs_auth":"yes","worst_case":"Low-privileged local user takes over the framework with full impact","analyst_note":"Find the Oracle security alert and fixed AHF release for 26.3-26.8 and the exact version-check command.","how_to_check":"- Check the installed AHF version against the affected range (26.3 to 26.8) with the AHF tooling on the host, for example `ahfctl version` (unknown if the sources give the exact command)\n- Confirm whether AHF is installed on hosts where local users have shell access","needs_analyst":true,"not_affected_if":["no-ahf-installed","no-shared-host-logons"],"who_is_affected":"Hosts that run Oracle Autonomous Health Framework in versions 26.3 through 26.8 and that let other users log on locally are exposed, since the attacker must already have a logon on the infrastructure. Systems where AHF is not installed, or where only trusted administrators can log on, carry much less risk.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000669,"input_tokens":3475,"output_tokens":643,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-101452':17A,20A '-2026':16A,19A '-26.8':99C '/av':152C '26.3':98C '3.1':139C,151C '7.8':142C 'affect':96C 'ahf':38B,88C 'allow':103C 'attack':67B,106C,125C 'autonom':2A,22B,34B,84C,114C,121C,135C 'autonomous-health-framework':21B 'avail':80B,146C 'base':140C 'compon':42B,87C 'compromis':119C 'confidenti':77B,143C 'control':69B 'cve':15A,18A 'cvss':138C,148C,150C 'databas':32B 'diagnost':40B,90C 'easili':100C 'execut':117C 'exploit':64B,101C 'flaw':45B 'framework':4A,24B,36B,72B,86C,116C,123C,137C 'full':68B 'give':65B 'h':160C 'h/a':159C 'h/i':158C 'health':3A,23B,35B,85C,115C,122C,136C 'high':74B 'host':59B 'impact':75B,147C 'infrastructur':111C 'instant':39B,89C 'integr':78B,144C 'l/ac':153C 'l/pr':154C 'l/ui':155C 'let':47B 'linux':25B 'local':5A 'log':55B 'logon':108C 'low':7A,50B,104C 'low-privileg':6A,49B 'n/s':156C 'on-prem':26B 'oracl':1A,29B,31B,33B,83C,113C,120C,134C 'oracle-databas':30B 'prem':28B 'privileg':8A,51B,105C 'replay':41B,91C 'result':130C 'score':141C 'success':63B,124C 'support':92C 'take':11A,60B 'takeov':132C 'tool':14A 'u/c':157C 'user':9A,52B 'vector':149C 'version':93C 'vulner':81C,102C,128C","nicknames":[],"mitigations":[],"who_affected":"Hosts that run Oracle Autonomous Health Framework in versions 26.3 through 26.8 and that let other users log on locally are exposed, since the attacker must already have a logon on the infrastructure. Systems where AHF is not installed, or where only trusted administrators can log on, carry much less risk.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:17:53+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-101452","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101452","severity":null,"published_at":"2026-10-20T22:17:53+00:00","modified_at":"2026-10-21T14:29:49+00:00","first_seen_at":"2026-10-23T21:57:21+00:00","fetched_at":"2026-10-23T22:28:58+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}