Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
3.8

Oracle TimesTen In-Memory Database (Kubernetes Operator) - Unauthorized Data Access

CVE-2026-60405 · published 3 months ago
Summary

A vulnerability in Oracle TimesTen In-Memory Database's Kubernetes Operator (version 26.1.1.1.0) allows an attacker with basic access to the system to read sensitive data without permission. This issue affects the security of data stored in TimesTen In-Memory Database, and we recommend updating to a fixed version to prevent unauthorized access.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
oracle corporation timesten in-memory database 26.1.1.1.0
oracle timesten_in-memory_database 26.1.1.1.0
cpe:2.3:a:oracle:timesten_in-memory_database:26.1.1.1.0:*:*:*:*:*:*:*
Original advisory text
Vulnerability in the TimesTen In-Memory Database product of Oracle TimesTen In-Memory Database (component: Kubernetes Operator). The supported version that is affected is 26.1.1.1.0. Easily explo...
Vulnerability in the TimesTen In-Memory Database product of Oracle TimesTen In-Memory Database (component: Kubernetes Operator). The supported version that is affected is 26.1.1.1.0. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where TimesTen In-Memory Database executes to compromise TimesTen In-Memory Database. While the vulnerability is in TimesTen In-Memory Database, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized read access to a subset of TimesTen In-Memory Database accessible data. CVSS 3.1 Base Score 3.8 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N).
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
3.8 Low
Exploitation
<1% chance of attack within 30 days
Type
CWE-200Information Exposure
Timeline
Published21 Jul 2026
Updated26 Oct 2026
First seen24 Jul 2026
Sources
CVE-2026-60405 · NVD
CVE-2026-60405 · MITRE
Track software like this
Free during beta