{"id":"CVE-2026-101485","kind":"vulnerability","aliases":["CVE-2026-101485"],"related":[],"title":"Oracle Autonomous Health Framework: Trace File Analyzer flaw exposes data to local users","description":"Vulnerability in Oracle Autonomous Health Framework (component: Trace File Analyzer).  Supported versions that are affected are 26.3-26.8. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Autonomous Health Framework executes to compromise Oracle Autonomous Health Framework.  While the vulnerability is in Oracle Autonomous Health Framework, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Autonomous Health Framework accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N).","summary":"Oracle Autonomous Health Framework's Trace File Analyzer component has a flaw that lets a low-privileged user with logon to the host reach data they should not see. The CVSS vector scores it as high confidentiality impact with scope change, and no integrity or availability impact.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["autonomous-health-framework","database-ops","infrastructure","on-prem","oracle","trace-file-analyzer"],"not_affected_if":["not-running-ahf","versions-outside-26.3-26.8"],"how_to_check":"- Check the installed Autonomous Health Framework version against the affected range `26.3` to `26.8` in the Oracle advisory\n- Run `unknown` to find the TFA install location if the sources do not say where it is","fix":"- Apply the Oracle Critical Patch Update fix for Autonomous Health Framework, version to move to: unknown (the sources do not name the patched release)","status":"open","published_at":"2026-10-20T22:17:57+00:00","first_seen_at":"2026-10-23T21:57:22+00:00","triaged_at":"2026-10-25T03:55:26+00:00","updated_at":"2026-10-25T03:55:26+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-25T03:55:26Z","model":"claude-haiku-5-5","output":{"fix":"- Apply the Oracle Critical Patch Update fix for Autonomous Health Framework, version to move to: unknown (the sources do not name the patched release)","reach":"local","title":"Oracle Autonomous Health Framework: Trace File Analyzer flaw exposes data to local users","impact":"medium","summary":"Oracle Autonomous Health Framework's Trace File Analyzer component has a flaw that lets a low-privileged user with logon to the host reach data they should not see. The CVSS vector scores it as high confidentiality impact with scope change, and no integrity or availability impact.","category":"infrastructure","nicknames":[],"who_cares":["oracle","autonomous-health-framework","trace-file-analyzer","on-prem","database-ops"],"confidence":0.6,"needs_auth":"yes","worst_case":"Local low-privileged user reads sensitive data from the framework","analyst_note":"Find the Oracle Security Alert or CPU advisory for the patched AHF release and the exact fixed version; NVD text gives only the affected range.","how_to_check":"- Check the installed Autonomous Health Framework version against the affected range `26.3` to `26.8` in the Oracle advisory\n- Run `unknown` to find the TFA install location if the sources do not say where it is","needs_analyst":true,"not_affected_if":["not-running-ahf","versions-outside-26.3-26.8"],"who_is_affected":"Systems running Oracle Autonomous Health Framework in the affected range `26.3` to `26.8`, where the Trace File Analyzer component is installed. The attacker needs a local logon on the same infrastructure, so hosts with no untrusted local users are at lower practical risk. Teams not running this Oracle product can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000669,"input_tokens":3514,"output_tokens":636,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-101485':16A,19A '-2026':15A,18A '-26.8':101C '/av':178C '26.3':100C '3.1':168C,177C '6.5':171C 'access':152C,158C,165C 'addit':139C 'affect':98C 'allow':105C 'analyz':7A,35B,43B,93C 'attack':108C,135C,144C 'autonom':2A,21B,37B,87C,116C,123C,132C,162C 'autonomous-health-framework':20B 'avail':82B 'base':169C 'c/c':183C 'chang':77B,142C 'complet':157C 'compon':44B,90C 'compromis':121C 'confidenti':73B,172C 'critic':154C 'cve':14A,17A 'cvss':67B,167C,174C,176C 'data':10A,61B,155C,166C 'databas':25B 'database-op':24B 'easili':102C 'execut':119C 'exploit':103C 'expos':9A 'file':6A,34B,42B,92C 'flaw':8A,47B 'framework':4A,23B,39B,89C,118C,125C,134C,164C 'h/i':184C 'health':3A,22B,38B,88C,117C,124C,133C,163C 'high':72B 'host':59B 'impact':74B,83B,138C,173C 'infrastructur':27B,113C 'integr':80B 'l/ac':179C 'l/pr':180C 'l/ui':181C 'let':49B 'local':12A 'logon':56B,110C 'low':52B,106C 'low-privileg':51B 'may':136C 'n':186C 'n/a':185C 'n/s':182C 'on-prem':28B 'op':26B 'oracl':1A,31B,36B,86C,115C,122C,131C,161C 'prem':30B 'privileg':53B,107C 'product':140C 'reach':60B 'result':149C 'scope':76B,141C 'score':69B,170C 'see':65B 'signific':137C 'success':143C 'support':94C 'trace':5A,33B,41B,91C 'trace-file-analyz':32B 'unauthor':151C 'user':13A,54B 'vector':68B,175C 'version':95C 'vulner':84C,104C,128C,147C","nicknames":[],"mitigations":[],"who_affected":"Systems running Oracle Autonomous Health Framework in the affected range `26.3` to `26.8`, where the Trace File Analyzer component is installed. The attacker needs a local logon on the same infrastructure, so hosts with no untrusted local users are at lower practical risk. Teams not running this Oracle product can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:17:57+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-101485","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101485","severity":null,"published_at":"2026-10-20T22:17:57+00:00","modified_at":"2026-10-21T14:29:49+00:00","first_seen_at":"2026-10-23T21:57:22+00:00","fetched_at":"2026-10-23T22:28:58+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}