---
id: "CVE-2026-101452"
kind: "vulnerability"
aliases: ["CVE-2026-101452"]
title: "Oracle Autonomous Health Framework: local low-privilege users can take over the tool"
severity: "high"
cvss: 7.8
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["autonomous-health-framework", "linux", "on-prem", "oracle", "oracle-database", "other"]
not_affected_if: ["no-ahf-installed", "no-shared-host-logons"]
published_at: "2026-10-20T22:17:53+00:00"
first_seen_at: "2026-10-23T21:57:21+00:00"
updated_at: "2026-10-25T03:10:07+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-101452", "first_seen_at": "2026-10-23T21:57:21+00:00"}]
---

# Oracle Autonomous Health Framework: local low-privilege users can take over the tool

Oracle Autonomous Health Framework's AHF Instant Diagnostic Replay component has a flaw that lets a low-privileged user who can log on to the host take it over. Successful exploitation gives the attacker full control of the framework, with high impact to confidentiality, integrity and availability.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed AHF version against the affected range (26.3 to 26.8) with the AHF tooling on the host, for example `ahfctl version` (unknown if the sources give the exact command)
- Confirm whether AHF is installed on hosts where local users have shell access

## Fix

- Move AHF to a version later than `26.8` once Oracle publishes the fixed release (unknown: the sources do not name the fixed version)
- Restrict shell logons on hosts running AHF to trusted administrators until patched

## Timeline

- 2026-10-23T21:57:21+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-101452

## From the sources

Vulnerability in Oracle Autonomous Health Framework (component: AHF Instant Diagnostic Replay).  Supported versions that are affected are 26.3-26.8. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Autonomous Health Framework executes to compromise Oracle Autonomous Health Framework.  Successful attacks of this vulnerability can result in takeover of Oracle Autonomous Health Framework. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_