CVE-2026-60172

Vulnerability in Oracle Autonomous Health Framework (component: Developer triaging platform). Supported versions that are affected are 26.0.0, 26.1.0 and 26.2.0. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where Oracle Autonomous Health Framework executes to compromise Oracle Autonomous Health Framework. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle Autonomous Health Framework. CVSS 3.1 Base Score 6.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H).

CVSS v3 6.3 MEDIUM

6.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 0.3 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity HIGH

Privileges Required HIGH

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://www.oracle.com/security-alerts/cpujul2026.html	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:oracle:autonomous_health_framework:26.0.0:::::::*
	cpe:2.3:a:oracle:autonomous_health_framework:26.1.0:::::::*
	cpe:2.3:a:oracle:autonomous_health_framework:26.2.0:::::::*

History

06 Aug 2026, 14:50

Type	Values Removed	Values Added
CPE		cpe:2.3:a:oracle:autonomous_health_framework:26.1.0:::::::* cpe:2.3:a:oracle:autonomous_health_framework:26.0.0:::::::* cpe:2.3:a:oracle:autonomous_health_framework:26.2.0:::::::*
First Time		Oracle Oracle autonomous Health Framework
References	~~() https://www.oracle.com/security-alerts/cpujul2026.html -~~	() https://www.oracle.com/security-alerts/cpujul2026.html - Vendor Advisory

23 Jul 2026, 17:16

Type	Values Removed	Values Added
CWE		CWE-284

21 Jul 2026, 22:17

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-07-21 22:17

Updated : 2026-08-06 14:50

NVD link : CVE-2026-60172

Mitre link : CVE-2026-60172

CVE.ORG link : CVE-2026-60172

JSON object : View

Products Affected

oracle

autonomous_health_framework

CWE

CWE-284

Improper Access Control

{"id": "CVE-2026-60172", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-60172", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-07-23T16:21:24.549943Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "secalert_us@oracle.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.3, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 0.3}]}, "affected": [{"source": "secalert_us@oracle.com", "affectedData": [{"vendor": "Oracle Corporation", "product": "Oracle Autonomous Health Framework", "versions": [{"status": "affected", "version": "26.0.0", "versionType": "semver"}, {"status": "affected", "version": "26.1.0", "versionType": "semver"}, {"status": "affected", "version": "26.2.0", "versionType": "semver"}]}]}], "published": "2026-07-21T22:17:18.050", "references": [{"url": "https://www.oracle.com/security-alerts/cpujul2026.html", "tags": ["Vendor Advisory"], "source": "secalert_us@oracle.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-284"}]}], "descriptions": [{"lang": "en", "value": "Vulnerability in Oracle Autonomous Health Framework (component: Developer triaging platform). Supported versions that are affected are 26.0.0, 26.1.0 and 26.2.0. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where Oracle Autonomous Health Framework executes to compromise Oracle Autonomous Health Framework. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle Autonomous Health Framework. CVSS 3.1 Base Score 6.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H)."}], "lastModified": "2026-08-06T14:50:38.267", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:oracle:autonomous_health_framework:26.0.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "DE83EB5D-E0F9-41CA-B2B7-50BEFFA9B6CF"}, {"criteria": "cpe:2.3:a:oracle:autonomous_health_framework:26.1.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3907FCA7-27FB-43DE-A235-620C667C2844"}, {"criteria": "cpe:2.3:a:oracle:autonomous_health_framework:26.2.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "471170FE-118C-4D4E-AD3D-5A23F9FA9CAE"}], "operator": "OR"}]}], "sourceIdentifier": "secalert_us@oracle.com"}