CVE-2026-70728: High severity Oracle Oracle Autonomous Health Framework (Trace File Analyzer) vulnerability
Vulnerability in Oracle Autonomous Health Framework (component: Trace File Analyzer). Supported versions that are affected are 26-26.1.0, 26.2.0, 26.3.1, 26.5.0 and 26.5.2. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Autonomous Health Framework. While the vulnerability is in Oracle Autonomous Health Framework, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Autonomous Health Framework accessible data as well as unauthorized update, insert or delete access to some of Oracle Autonomous Health Framework accessible data. CVSS 3.1 Base Score 8.5 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N).
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this vulnerability?
Oracle Autonomous Health Framework deployments using the Trace File Analyzer component are affected if they run versions 26 through 26.1.0, 26.2.0, 26.3.1, 26.5.0, or 26.5.2 and are reachable over HTTP by an attacker with low-privileged access.
What does an attacker need to exploit it?
The attacker needs network access via HTTP and a low-privileged account or equivalent low-level privileges. No user interaction is required, and exploitation is described as easy.
What could a successful attack allow?
A successful attack can expose critical data or all data accessible to Oracle Autonomous Health Framework, and can allow unauthorized update, insert, or delete operations on some accessible data. The impact may extend to additional products because the vulnerability has scope change.
How can I determine whether my environment is affected?
Identify Oracle Autonomous Health Framework instances with the Trace File Analyzer component, verify whether they expose HTTP access, and compare their supported version against the affected versions listed. Systems not running one of the listed affected versions are not identified as affected by the provided data.