CVE-2026-70717: High severity Oracle Oracle Autonomous Health Framework (Cluster Health Analyzer) vulnerability
Vulnerability in Oracle Autonomous Health Framework (component: Cluster Health Analyzer). Supported versions that are affected are 26-26.1.0, 26.2.0, 26.3.1, 26.5.0 and 26.5.2. Difficult to exploit vulnerability allows low privileged attacker with access to the physical communication segment attached to the hardware where the Oracle Autonomous Health Framework executes to compromise Oracle Autonomous Health Framework. While the vulnerability is in Oracle Autonomous Health Framework, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Autonomous Health Framework accessible data as well as unauthorized access to critical data or complete access to all Oracle Autonomous Health Framework accessible data. CVSS 3.1 Base Score 7.7 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N).
Affected Software
Event History
Frequently Asked Questions
Who is realistically exposed to exploitation?
Affected deployments are Oracle Autonomous Health Framework systems using the Cluster Health Analyzer component in versions 26 through 26.5.2 as listed. An attacker must have access to the physical communication segment attached to the hardware where the framework runs and must already hold low-level privileges.
Does exploitation require user interaction or network access?
No user interaction is required. The attack vector is adjacent: the attacker needs access to the relevant physical communication segment rather than remote network-only access.
What impact could a successful attack have beyond the affected component?
A successful attack can provide unauthorized read, creation, deletion, or modification access to critical data or all data accessible to Oracle Autonomous Health Framework. The scope change indicates that additional products may be significantly affected by an attack even though the vulnerability is in Oracle Autonomous Health Framework.