This vulnerability in Oracle Autonomous Health Framework (Trace File Analyzer component) permits a low privileged attacker with network access via HTTP to compromise the framework. Successful exploitation can result in unauthorized access to critical data or complete access to all data accessible by the framework, as well as unauthorized update, insert, or delete operations on some data. The vulnerability affects versions 26, 26.0 through 26.1.0, 26.2.0, 26.3.1, 26.5.0, and 26.5.2. The CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N with a base score of 8.5. Oracle has addressed this vulnerability in its August 2026 Critical Security Patch Update.

Exploitation of this vulnerability can lead to unauthorized access to sensitive or critical data within Oracle Autonomous Health Framework and unauthorized modification (update, insert, delete) of some accessible data. The vulnerability's scope change means it may impact additional Oracle products beyond the framework itself. The high CVSS score reflects significant confidentiality and integrity impacts, though availability is not affected.

Oracle has released a Critical Security Patch Update in August 2026 that addresses this vulnerability. Customers are strongly advised to apply the relevant security patches promptly to affected versions of Oracle Autonomous Health Framework. Oracle recommends remaining on actively supported versions and applying patches without delay. No alternative mitigations or workarounds are specified in the advisory.