CVE-2026-60405

Analyzed Analyzed - Analysis Complete

TimesTen In-Memory Database Unauthorized Data Read Vulnerability

Publication date: 2026-07-21

Last updated on: 2026-07-31

Assigner: Oracle

Description

Vulnerability in the TimesTen In-Memory Database product of Oracle TimesTen In-Memory Database (component: Kubernetes Operator). The supported version that is affected is 26.1.1.1.0. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where TimesTen In-Memory Database executes to compromise TimesTen In-Memory Database. While the vulnerability is in TimesTen In-Memory Database, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized read access to a subset of TimesTen In-Memory Database accessible data. CVSS 3.1 Base Score 3.8 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-21

Last Modified

2026-07-31

Generated

2026-08-11

AI Q&A

2026-07-22

EPSS Evaluated

2026-08-09

NVD

CVE-2026-60405

EUVD

EUVD-2026-46807

Affected Vendors & Products

Vendor	Product	Version / Range
oracle	timesten_in-memory_database	26.1.1.1.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-200	The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

Executive Summary

This is a vulnerability in Oracle TimesTen In-Memory Database's Kubernetes Operator component affecting version 26.1.1.1.0. It allows a low-privileged attacker with local system access to read a subset of the database's data. The attack requires logon to the infrastructure where the database runs.

Detection Guidance

The provided CVE data does not include specific detection methods or commands for identifying this vulnerability on a network or system. Detection would typically involve checking the TimesTen In-Memory Database version and configuration for exposure to this issue.

Impact Analysis

If you use the affected TimesTen In-Memory Database version, an attacker with local access could read sensitive data stored in the database. This could lead to unauthorized information disclosure, though it does not allow modification or deletion of data.

Compliance Impact

This vulnerability could impact compliance by enabling unauthorized data access, which violates principles of data protection in regulations like GDPR and HIPAA. Organizations may face penalties if this leads to data breaches.

Mitigation Strategies

Apply the latest security patches or updates provided by Oracle for TimesTen In-Memory Database version 26.1.1.1.0. Restrict user privileges to minimize access to sensitive data. Monitor logs for suspicious activities related to database access.

Hi! I’m here to help you understand CVE-2026-60405. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70