---
id: "CVE-2026-101477"
kind: "vulnerability"
aliases: ["CVE-2026-101477"]
title: "Oracle Autonomous Health Framework: local low-privilege user can take over"
severity: "high"
cvss: 7.8
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["autonomous-health-framework", "oracle", "package", "self-hosted", "trace-file-analyzer"]
not_affected_if: ["no-local-logins"]
published_at: "2026-10-20T22:17:56+00:00"
first_seen_at: "2026-10-23T21:57:22+00:00"
updated_at: "2026-10-25T03:10:05+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-101477", "first_seen_at": "2026-10-23T21:57:22+00:00"}]
---

# Oracle Autonomous Health Framework: local low-privilege user can take over

Oracle Autonomous Health Framework's Trace File Analyzer component has a flaw that lets a low-privileged logged-in user on the host take over the framework. The sources describe the impact as full takeover with high confidentiality, integrity and availability loss (CVSS 3.1 7.8, local attack vector).

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- unknown

## Fix

- unknown

## Timeline

- 2026-10-23T21:57:22+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-101477

## From the sources

Vulnerability in Oracle Autonomous Health Framework (component: Trace File Analyzer).  Supported versions that are affected are 26.3-26.8. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Autonomous Health Framework executes to compromise Oracle Autonomous Health Framework.  Successful attacks of this vulnerability can result in takeover of Oracle Autonomous Health Framework. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_