---
id: "CVE-2026-101485"
kind: "vulnerability"
aliases: ["CVE-2026-101485"]
title: "Oracle Autonomous Health Framework: Trace File Analyzer flaw exposes data to local users"
severity: "medium"
cvss: 6.5
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["autonomous-health-framework", "database-ops", "infrastructure", "on-prem", "oracle", "trace-file-analyzer"]
not_affected_if: ["not-running-ahf", "versions-outside-26.3-26.8"]
published_at: "2026-10-20T22:17:57+00:00"
first_seen_at: "2026-10-23T21:57:22+00:00"
updated_at: "2026-10-25T03:55:26+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-101485", "first_seen_at": "2026-10-23T21:57:22+00:00"}]
---

# Oracle Autonomous Health Framework: Trace File Analyzer flaw exposes data to local users

Oracle Autonomous Health Framework's Trace File Analyzer component has a flaw that lets a low-privileged user with logon to the host reach data they should not see. The CVSS vector scores it as high confidentiality impact with scope change, and no integrity or availability impact.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Autonomous Health Framework version against the affected range `26.3` to `26.8` in the Oracle advisory
- Run `unknown` to find the TFA install location if the sources do not say where it is

## Fix

- Apply the Oracle Critical Patch Update fix for Autonomous Health Framework, version to move to: unknown (the sources do not name the patched release)

## Timeline

- 2026-10-23T21:57:22+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-101485

## From the sources

Vulnerability in Oracle Autonomous Health Framework (component: Trace File Analyzer).  Supported versions that are affected are 26.3-26.8. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Autonomous Health Framework executes to compromise Oracle Autonomous Health Framework.  While the vulnerability is in Oracle Autonomous Health Framework, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Autonomous Health Framework accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_