Executive brief
Oracle Autonomous Health Framework is a monitoring and diagnostic tool used to manage database cluster health. An attacker with low-level system privileges and physical access to the network infrastructure can exploit a weakness in the Cluster Health Analyzer component to gain unauthorized access to and modify critical database data. This could compromise data confidentiality and integrity across systems dependent on the framework.
Technical details
This is a privilege escalation vulnerability in the Cluster Health Analyzer component of Oracle Autonomous Health Framework. The weakness allows a low-privileged attacker with access to the physical communication segment (adjacent network) to bypass security controls, despite high complexity exploitation requirements. The vulnerability has a scope change, meaning successful exploitation can impact additional products beyond the framework itself. Attackers can achieve unauthorized creation, deletion, and modification of critical data, as well as complete read access to all framework-accessible data. Affected versions include 26.0 through 26.5.2. Oracle has published a patch as part of their August 2026 Critical Patch Update.
Affected products
- Oracle Autonomous Health Framework 26.0-26.5.2
Timeline
- 2026-08-18: disclosed
- 2026-08-18: patched: patch released in Oracle Critical Patch Update for August 2026