CVE-2026-60407

Analyzed Analyzed - Analysis Complete

Memory Corruption in TimesTen In-Memory Database

Publication date: 2026-07-21

Last updated on: 2026-07-31

Assigner: Oracle

Description

Vulnerability in the TimesTen In-Memory Database product of Oracle TimesTen In-Memory Database (component: Kubernetes Operator). The supported version that is affected is 26.1.1.1.0. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where TimesTen In-Memory Database executes to compromise TimesTen In-Memory Database. While the vulnerability is in TimesTen In-Memory Database, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all TimesTen In-Memory Database accessible data. CVSS 3.1 Base Score 5.6 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-21

Last Modified

2026-07-31

Generated

2026-08-11

AI Q&A

2026-07-22

EPSS Evaluated

2026-08-09

NVD

CVE-2026-60407

EUVD

EUVD-2026-46809

Affected Vendors & Products

Vendor	Product	Version / Range
oracle	timesten_in-memory_database	26.1.1.1.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-284	The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Attack-Flow Graph

Executive Summary

This is a vulnerability in Oracle TimesTen In-Memory Database's Kubernetes Operator component affecting version 26.1.1.1.0. It allows a low-privileged attacker with system access to potentially compromise the database and access sensitive data due to improper access controls.

Detection Guidance

Detection requires checking for vulnerable versions of Oracle TimesTen In-Memory Database, specifically version 26.1.1.1.0. Review Kubernetes Operator logs and configurations for unauthorized access attempts or anomalies in database interactions.

Impact Analysis

An attacker could gain unauthorized access to critical or all accessible data stored in the TimesTen In-Memory Database. This may lead to data breaches, information theft, or further system compromise depending on the database contents.

Compliance Impact

This vulnerability could lead to unauthorized data access, potentially violating GDPR's data protection requirements or HIPAA's safeguards for protected health information. Organizations may face compliance violations, fines, or legal consequences if such breaches occur.

Mitigation Strategies

Apply the latest security patches or updates provided by Oracle for TimesTen In-Memory Database version 26.1.1.1.0. Restrict access to the infrastructure where TimesTen executes by limiting user privileges and monitoring logon activities.

Hi! I’m here to help you understand CVE-2026-60407. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70