Quick answers
- Is CVE-2026-70717 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-70717 being exploited in the wild.
- How severe is CVE-2026-70717?
- High severity, with a CVSS score of 7.7, published 18 August 2026.
- Which products and versions are affected?
- Oracle Autonomous Health Framework 26.0-26.5.2.
- Is there a fix for CVE-2026-70717?
- A patch was published on 2026-08-18: patch released in Oracle Critical Patch Update for August 2026 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-70717 attacked?
- It is attacked from the adjacent network.
- Am I affected by CVE-2026-70717?
- Check whether you run Oracle Autonomous Health Framework at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
This is a privilege escalation vulnerability in the Cluster Health Analyzer component of Oracle Autonomous Health Framework. The weakness allows a low-privileged attacker with access to the physical communication segment (adjacent network) to bypass security controls, despite high complexity exploitation requirements. The vulnerability has a scope change, meaning successful exploitation can impact additional products beyond the framework itself. Attackers can achieve unauthorized creation, deletion, and modification of critical data, as well as complete read access to all framework-accessible data. Affected versions include 26.0 through 26.5.2. Oracle has published a patch as part of their August 2026 Critical Patch Update.
Affected products
- Oracle Autonomous Health Framework 26.0-26.5.2
Timeline
- 2026-08-18: disclosed
- 2026-08-18: patched: patch released in Oracle Critical Patch Update for August 2026