---
id: "CVE-2026-101478"
kind: "vulnerability"
aliases: ["CVE-2026-101478"]
title: "Oracle Autonomous Health Framework: local low-privilege user can take over"
severity: "high"
cvss: 7.8
epss: null
exploited: false
status: "open"
category: "vendor"
products: []
ecosystems: []
tags: ["database-ops", "oracle", "oracle-autonomous-health-framework", "self-hosted", "vendor"]
not_affected_if: ["version-outside-26.3-26.8"]
published_at: "2026-10-20T22:17:56+00:00"
first_seen_at: "2026-10-23T21:57:22+00:00"
updated_at: "2026-10-25T03:10:03+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-101478", "first_seen_at": "2026-10-23T21:57:22+00:00"}]
---

# Oracle Autonomous Health Framework: local low-privilege user can take over

Oracle Autonomous Health Framework's Trace File Analyzer component has a flaw that lets a low-privileged user with logon to the host take over the framework. The sources report full confidentiality, integrity and availability impact (CVSS 7.8).

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Oracle Autonomous Health Framework version against the affected range 26.3-26.8 in the Oracle advisory
- unknown for any other command or file path, as the sources do not say

## Fix

- Move Oracle Autonomous Health Framework to a release outside 26.3-26.8, as listed in the Oracle security advisory
- unknown for the exact fixed version, as the sources do not say

## Timeline

- 2026-10-23T21:57:22+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-101478

## From the sources

Vulnerability in Oracle Autonomous Health Framework (component: Trace File Analyzer).  Supported versions that are affected are 26.3-26.8. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Autonomous Health Framework executes to compromise Oracle Autonomous Health Framework.  Successful attacks of this vulnerability can result in takeover of Oracle Autonomous Health Framework. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_