CVE-2026-60402
CriticalCVSS 9.9Exploitation Probability (EPSS)
Low risk21th percentile - higher than 21% of all known CVEs
Summary
Vulnerability in Oracle TimesTen In-Memory Database (Kubernetes Operator component) allows a low-privileged attacker with network access via HTTPS to take over the database. Attacks may impact additional products (scope change).
Risk Assessment
Risk of full compromise of the TimesTen database and potentially other systems, leading to loss of confidentiality, integrity, and availability.
Recommendation
Apply the Oracle patch for version 26.1.1.1.0 immediately. Restrict network access to the HTTPS interface of the Kubernetes Operator.
Other vulnerabilities in Oracle TimesTen In-Memory Database
See all- CVE-2026-60411Medium
Vulnerability in Oracle TimesTen In-Memory Database (ttcserver component) version 26.1.1.1.0. An unauthenticated attacker with access to the physical communication segment can cause a hang or frequent crash (complete DOS) of the database.
- CVE-2026-60407Medium
Vulnerability in Oracle TimesTen In-Memory Database (component: Kubernetes Operator) version 26.1.1.1.0. It is difficult to exploit, requires local access and low privileges. Successful attack can lead to unauthorized access to critical data or full access to all database data.
Original NVD description (English source)
Vulnerability in the TimesTen In-Memory Database product of Oracle TimesTen In-Memory Database (component: Kubernetes Operator). The supported version that is affected is 26.1.1.1.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTPS to compromise TimesTen In-Memory Database. While the vulnerability is in TimesTen In-Memory Database, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of TimesTen In-Memory Database. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).