{"id":"CVE-2026-101478","kind":"vulnerability","aliases":["CVE-2026-101478"],"related":[],"title":"Oracle Autonomous Health Framework: local low-privilege user can take over","description":"Vulnerability in Oracle Autonomous Health Framework (component: Trace File Analyzer).  Supported versions that are affected are 26.3-26.8. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Autonomous Health Framework executes to compromise Oracle Autonomous Health Framework.  Successful attacks of this vulnerability can result in takeover of Oracle Autonomous Health Framework. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).","summary":"Oracle Autonomous Health Framework's Trace File Analyzer component has a flaw that lets a low-privileged user with logon to the host take over the framework. The sources report full confidentiality, integrity and availability impact (CVSS 7.8).","severity":"high","cvss":7.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["database-ops","oracle","oracle-autonomous-health-framework","self-hosted","vendor"],"not_affected_if":["version-outside-26.3-26.8"],"how_to_check":"- Check the installed Oracle Autonomous Health Framework version against the affected range 26.3-26.8 in the Oracle advisory\n- unknown for any other command or file path, as the sources do not say","fix":"- Move Oracle Autonomous Health Framework to a release outside 26.3-26.8, as listed in the Oracle security advisory\n- unknown for the exact fixed version, as the sources do not say","status":"open","published_at":"2026-10-20T22:17:56+00:00","first_seen_at":"2026-10-23T21:57:22+00:00","triaged_at":"2026-10-25T03:10:03+00:00","updated_at":"2026-10-25T03:10:03+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-10-25T03:10:03Z","model":"claude-haiku-5-5","output":{"fix":"- Move Oracle Autonomous Health Framework to a release outside 26.3-26.8, as listed in the Oracle security advisory\n- unknown for the exact fixed version, as the sources do not say","reach":"local","title":"Oracle Autonomous Health Framework: local low-privilege user can take over","impact":"high","summary":"Oracle Autonomous Health Framework's Trace File Analyzer component has a flaw that lets a low-privileged user with logon to the host take over the framework. The sources report full confidentiality, integrity and availability impact (CVSS 7.8).","category":"vendor","nicknames":[],"who_cares":["oracle","oracle-autonomous-health-framework","self-hosted","database-ops"],"confidence":0.6,"needs_auth":"yes","worst_case":"Low-privileged local user takes over the framework and reads or changes data","analyst_note":"Find the Oracle Critical Patch Update advisory for CVE-2026-101478 to confirm fixed versions and the exact configuration needed.","how_to_check":"- Check the installed Oracle Autonomous Health Framework version against the affected range 26.3-26.8 in the Oracle advisory\n- unknown for any other command or file path, as the sources do not say","needs_analyst":true,"not_affected_if":["version-outside-26.3-26.8"],"who_is_affected":"Teams running Oracle Autonomous Health Framework with the Trace File Analyzer component on hosts where other users have logon access. The sources list supported versions 26.3 through 26.8 as affected. Systems without this framework, or outside that version range, can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000642,"input_tokens":3463,"output_tokens":591,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-101478':14A,17A '-2026':13A,16A '-26.8':87C '/av':140C '26.3':86C '3.1':127C,139C '7.8':69B,130C 'affect':84C 'allow':91C 'analyz':38B,79C 'attack':94C,113C 'autonom':2A,24B,32B,73C,102C,109C,123C 'avail':66B,134C 'base':128C 'compon':39B,76C 'compromis':107C 'confidenti':63B,131C 'cve':12A,15A 'cvss':68B,126C,136C,138C 'databas':19B 'database-op':18B 'easili':88C 'execut':105C 'exploit':89C 'file':37B,78C 'flaw':42B 'framework':4A,26B,34B,58B,75C,104C,111C,125C 'full':62B 'h':148C 'h/a':147C 'h/i':146C 'health':3A,25B,33B,74C,103C,110C,124C 'host':29B,54B 'impact':67B,135C 'infrastructur':99C 'integr':64B,132C 'l/ac':141C 'l/pr':142C 'l/ui':143C 'let':44B 'local':5A 'logon':51B,96C 'low':7A,47B,92C 'low-privileg':6A,46B 'n/s':144C 'op':20B 'oracl':1A,21B,23B,31B,72C,101C,108C,122C 'oracle-autonomous-health-framework':22B 'privileg':8A,48B,93C 'report':61B 'result':118C 'score':129C 'self':28B 'self-host':27B 'sourc':60B 'success':112C 'support':80C 'take':11A,55B 'takeov':120C 'trace':36B,77C 'u/c':145C 'user':9A,49B 'vector':137C 'vendor':30B 'version':81C 'vulner':70C,90C,116C","nicknames":[],"mitigations":[],"who_affected":"Teams running Oracle Autonomous Health Framework with the Trace File Analyzer component on hosts where other users have logon access. The sources list supported versions 26.3 through 26.8 as affected. Systems without this framework, or outside that version range, can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:17:56+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-101478","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101478","severity":null,"published_at":"2026-10-20T22:17:56+00:00","modified_at":"2026-10-21T14:29:49+00:00","first_seen_at":"2026-10-23T21:57:22+00:00","fetched_at":"2026-10-23T22:28:58+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}