CVE-2026-70715
Summary
| CVE | CVE-2026-70715 |
|---|---|
| State | PUBLISHED |
| Assigner | oracle |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2026-08-18 21:17:23 UTC |
| Updated | 2026-08-26 20:18:24 UTC |
| Description | Vulnerability in Oracle Autonomous Health Framework (component: Trace File Analyzer). Supported versions that are affected are 26-26.1.0, 26.2.0, 26.3.1, 26.5.0 and 26.5.2. Easily exploitable vulnerability allows unauthenticated attacker with access to the physical communication segment attached to the hardware where the Oracle Autonomous Health Framework executes to compromise Oracle Autonomous Health Framework. Successful attacks of this vulnerability can result in takeover of Oracle Autonomous Health Framework. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). |
Risk And Classification
Primary CVSS: v3.1 6.8 MEDIUM from [email protected]
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS: 0.003540000 probability, percentile 0.282020000 (date 2026-08-27)
Problem Types: CWE-284 | Easily exploitable vulnerability allows unauthenticated attacker with access to the physical communication segment attached to the hardware where the Oracle Autonomous Health Framework executes to compromise Oracle Autonomous Health Framework. Successful attacks of this vulnerability can result in takeover of Oracle Autonomous Health Framework. | CWE-284 CWE-284 Improper Access Control
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 3.1 | [email protected] | Primary | 6.8 | MEDIUM | CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| 3.1 | [email protected] | Secondary | 8.8 | HIGH | CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| 3.1 | CNA | DECLARED | 8.8 | HIGH | CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
CVSS v3.1 Breakdown
Attack Vector
PhysicalAttack Complexity
LowPrivileges Required
NoneUser Interaction
NoneScope
UnchangedConfidentiality
HighIntegrity
HighAvailability
HighCVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | Oracle | Autonomous Health Framework | 26.2.0 | All | All | All |
| Application | Oracle | Autonomous Health Framework | 26.3.1 | All | All | All |
| Application | Oracle | Autonomous Health Framework | 26.5.0 | All | All | All |
| Application | Oracle | Autonomous Health Framework | 26.5.2 | All | All | All |
| Application | Oracle | Autonomous Health Framework | All | All | All | All |
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | Oracle Corporation | Oracle Autonomous Health Framework | affected 26 26.1.0 custom | Not specified |
| CNA | Oracle Corporation | Oracle Autonomous Health Framework | affected 26.2.0 semver | Not specified |
| CNA | Oracle Corporation | Oracle Autonomous Health Framework | affected 26.3.1 semver | Not specified |
| CNA | Oracle Corporation | Oracle Autonomous Health Framework | affected 26.5.0 semver | Not specified |
| CNA | Oracle Corporation | Oracle Autonomous Health Framework | affected 26.5.2 semver | Not specified |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| www.oracle.com/security-alerts/cspuaug2026.html | [email protected] | www.oracle.com | Vendor Advisory |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.