{"id":"CVE-2026-101477","kind":"vulnerability","aliases":["CVE-2026-101477"],"related":[],"title":"Oracle Autonomous Health Framework: local low-privilege user can take over","description":"Vulnerability in Oracle Autonomous Health Framework (component: Trace File Analyzer).  Supported versions that are affected are 26.3-26.8. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Autonomous Health Framework executes to compromise Oracle Autonomous Health Framework.  Successful attacks of this vulnerability can result in takeover of Oracle Autonomous Health Framework. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).","summary":"Oracle Autonomous Health Framework's Trace File Analyzer component has a flaw that lets a low-privileged logged-in user on the host take over the framework. The sources describe the impact as full takeover with high confidentiality, integrity and availability loss (CVSS 3.1 7.8, local attack vector).","severity":"high","cvss":7.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["autonomous-health-framework","oracle","package","self-hosted","trace-file-analyzer"],"not_affected_if":["no-local-logins"],"how_to_check":"- unknown","fix":"- unknown","status":"open","published_at":"2026-10-20T22:17:56+00:00","first_seen_at":"2026-10-23T21:57:22+00:00","triaged_at":"2026-10-25T03:10:05+00:00","updated_at":"2026-10-25T03:10:05+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T03:10:05Z","model":"claude-haiku-5-5","output":{"fix":"- unknown","reach":"local","title":"Oracle Autonomous Health Framework: local low-privilege user can take over","impact":"high","summary":"Oracle Autonomous Health Framework's Trace File Analyzer component has a flaw that lets a low-privileged logged-in user on the host take over the framework. The sources describe the impact as full takeover with high confidentiality, integrity and availability loss (CVSS 3.1 7.8, local attack vector).","category":"package","nicknames":[],"who_cares":["oracle","autonomous-health-framework","trace-file-analyzer","self-hosted"],"confidence":0.6,"needs_auth":"yes","worst_case":"low-privilege local user takes over the framework, reading and changing all data","analyst_note":"Find Oracle's advisory or patch for AHF 26.3-26.8 to fill in fix and how_to_check; the NVD entry lacks them.","how_to_check":"- unknown","needs_analyst":true,"not_affected_if":["no-local-logins"],"who_is_affected":"Systems running Oracle Autonomous Health Framework in the affected 26.3 to 26.8 supported version range. The attacker needs a login on the infrastructure where the framework runs, so hosts with few interactive users are less exposed. unknown for exact version boundaries and patch releases.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000592,"input_tokens":3463,"output_tokens":492,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-101477':14A,17A '-2026':13A,16A '-26.8':98C '/av':151C '26.3':97C '3.1':76B,138C,150C '7.8':77B,141C 'affect':95C 'allow':102C 'analyz':30B,38B,90C 'attack':79B,105C,124C 'autonom':2A,19B,32B,84C,113C,120C,134C 'autonomous-health-framework':18B 'avail':73B,145C 'base':139C 'compon':39B,87C 'compromis':118C 'confidenti':70B,142C 'cve':12A,15A 'cvss':75B,137C,147C,149C 'describ':62B 'easili':99C 'execut':116C 'exploit':100C 'file':29B,37B,89C 'flaw':42B 'framework':4A,21B,34B,59B,86C,115C,122C,136C 'full':66B 'h':159C 'h/a':158C 'h/i':157C 'health':3A,20B,33B,85C,114C,121C,135C 'high':69B 'host':26B,55B 'impact':64B,146C 'infrastructur':110C 'integr':71B,143C 'l/ac':152C 'l/pr':153C 'l/ui':154C 'let':44B 'local':5A,78B 'log':50B 'logged-in':49B 'logon':107C 'loss':74B 'low':7A,47B,103C 'low-privileg':6A,46B 'n/s':155C 'oracl':1A,22B,31B,83C,112C,119C,133C 'packag':23B 'privileg':8A,48B,104C 'result':129C 'score':140C 'self':25B 'self-host':24B 'sourc':61B 'success':123C 'support':91C 'take':11A,56B 'takeov':67B,131C 'trace':28B,36B,88C 'trace-file-analyz':27B 'u/c':156C 'user':9A,52B 'vector':80B,148C 'version':92C 'vulner':81C,101C,127C","nicknames":[],"mitigations":[],"who_affected":"Systems running Oracle Autonomous Health Framework in the affected 26.3 to 26.8 supported version range. The attacker needs a login on the infrastructure where the framework runs, so hosts with few interactive users are less exposed. unknown for exact version boundaries and patch releases.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:17:56+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-101477","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101477","severity":null,"published_at":"2026-10-20T22:17:56+00:00","modified_at":"2026-10-21T14:29:49+00:00","first_seen_at":"2026-10-23T21:57:22+00:00","fetched_at":"2026-10-23T22:28:58+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}