CVE-2026-60406

Received Received - Intake

Privilege Escalation in TimesTen In-Memory Database Kubernetes Operator

Publication date: 2026-07-21

Last updated on: 2026-07-21

Assigner: Oracle

Description

Vulnerability in the TimesTen In-Memory Database product of Oracle TimesTen In-Memory Database (component: Kubernetes Operator). The supported version that is affected is 26.1.1.1.0. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where TimesTen In-Memory Database executes to compromise TimesTen In-Memory Database. Successful attacks of this vulnerability can result in takeover of TimesTen In-Memory Database. CVSS 3.1 Base Score 6.7 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-21

Last Modified

2026-07-21

Generated

2026-07-22

AI Q&A

2026-07-22

EPSS Evaluated

N/A

NVD

CVE-2026-60406

Affected Vendors & Products

Vendor	Product	Version / Range
oracle	timesten_in_memory_database	26.1.1.1.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a vulnerability in Oracle TimesTen In-Memory Database's Kubernetes Operator component, affecting version 26.1.1.1.0. It allows a high-privileged attacker with local system access to compromise the database, potentially leading to full takeover. The CVSS score is 6.7, indicating significant impact on confidentiality, integrity, and availability.

Detection Guidance

Detection requires checking for vulnerable versions of Oracle TimesTen In-Memory Database 26.1.1.1.0. Inspect Kubernetes Operator logs and configurations for unauthorized access attempts or unusual activity. No specific commands are provided in the context.

Impact Analysis

If you use the affected TimesTen In-Memory Database version, an attacker with local access could gain control of your database, leading to data theft, corruption, or service disruption. This requires high privileges but could result in complete system compromise.

Compliance Impact

This vulnerability could lead to unauthorized access or data breaches, violating GDPR (data protection) and HIPAA (health data security) requirements. Compliance may be compromised if sensitive data is exposed or altered due to the attack.

Mitigation Strategies

Apply the latest security patches from Oracle for TimesTen In-Memory Database 26.1.1.1.0. Restrict high privileged user access to the infrastructure hosting the database. Monitor logs for suspicious activity and ensure Kubernetes Operator configurations are secure.

Hi! I’m here to help you understand CVE-2026-60406. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70