This vulnerability in Oracle Autonomous Health Framework (Cluster Health Analyzer component) permits a low privileged attacker with access to the physical communication segment of the hardware to compromise the framework. The attack scope includes unauthorized creation, deletion, or modification of critical data accessible by the framework, with potential impact on other Oracle products. The CVSS 3.1 base score is 7.7, reflecting high confidentiality and integrity impacts. Affected versions include 26 through 26.1.0, 26.2.0, 26.3.1, 26.5.0, and 26.5.2. The vulnerability is difficult to exploit due to required physical access and high attack complexity.

Exploitation can result in unauthorized creation, deletion, or modification of critical data within the Oracle Autonomous Health Framework, compromising confidentiality and integrity. The vulnerability's scope change means other Oracle products relying on this framework may also be affected. No impact on availability is indicated. The attack requires physical access to the communication segment, limiting remote exploitation.

Oracle has released a Critical Security Patch Update in August 2026 addressing this and many other vulnerabilities. Customers are strongly advised to apply the available security patches promptly and remain on actively supported versions. No specific patch links were provided in the input, but the vendor advisory at https://www.oracle.com/security-alerts/cspuaug2026.html contains patch availability and installation instructions. No indication that the vulnerability is already mitigated or requires no action was found.