This vulnerability in Oracle Autonomous Health Framework (Trace File Analyzer component) enables a low privileged attacker with logon access to compromise the framework. The attack scope extends beyond the framework itself, potentially impacting additional Oracle products. Successful exploitation results in unauthorized modification of critical data and the ability to cause a hang or repeated crash, effectively a complete denial of service. The CVSS vector indicates low attack complexity and privileges required, no user interaction, and scope change with high integrity and availability impact. Affected versions include 26 through 26.1.0, 26.2.0, 26.3.1, 26.5.0, and 26.5.2.

The vulnerability allows unauthorized creation, deletion, or modification of critical data within Oracle Autonomous Health Framework and potentially impacts other Oracle products due to scope change. It also enables denial of service by causing hangs or frequent crashes of the framework. This compromises data integrity and system availability but does not affect confidentiality.

Oracle has released a Critical Security Patch Update (CSPU) in August 2026 addressing this vulnerability among others. Customers are strongly advised to apply the available security patches promptly to mitigate this vulnerability. No indication of 'no action required' or 'already mitigated' was provided, so patching is the recommended remediation. Refer to Oracle's official advisory at https://www.oracle.com/security-alerts/cspuaug2026.html for patch availability and installation instructions.