CVE-2026-60409
MediumCVSS 5.7Exploitation Probability (EPSS)
Low risk2th percentile - higher than 2% of all known CVEs
Summary
TimesTen In-Memory Database version 26.1.1.1.0 has a vulnerability in the Kubernetes Operator component. A privileged attacker with local access can unauthorizedly update, insert, or delete data, read a subset of data, and cause a partial denial of service (partial DOS), also affecting other products.
Risk Assessment
The risk includes compromise of confidentiality, integrity, and availability of data in TimesTen, which may affect applications using this database and other systems.
Recommendation
Apply the Oracle patch for TimesTen In-Memory Database version 26.1.1.1.0 or later that fixes this vulnerability.
Other vulnerabilities in TimesTen In-Memory Database
See all- CVE-2026-60410Medium
Vulnerability in TimesTen In-Memory Database (component: Kubernetes Operator) version 26.1.1.1.0. Easily exploitable flaw allows a low-privileged attacker with network access via HTTPS to cause a partial denial of service (partial DOS).
- CVE-2026-60408Medium
Vulnerability in TimesTen In-Memory Database (version 26.1.1.1.0) in the Kubernetes Operator component. A low-privileged attacker via HTTPS can gain unauthorized read access to data.
- CVE-2026-60406Medium
Vulnerability in TimesTen In-Memory Database (component: Kubernetes Operator) version 26.1.1.1.0. A high-privileged attacker with local access can take over the database.
- CVE-2026-60405Low
Vulnerability in TimesTen In-Memory Database (component: Kubernetes Operator) version 26.1.1.1.0. Allows a low-privileged attacker with local access to read unauthorized data, potentially affecting other products.
- CVE-2026-60404Medium
Vulnerability in TimesTen In-Memory Database (Kubernetes Operator component). A low-privileged attacker via HTTPS can cause a hang or frequent crashes (full DOS).
- CVE-2026-60403Medium
Vulnerability in TimesTen In-Memory Database (component: Kubernetes Operator). Affects version 26.1.1.1.0. A low-privileged attacker with network access via HTTPS can cause a complete denial of service (complete DOS) by hanging or frequent crashes.
- CVE-2026-60401Medium
A vulnerability in TimesTen In-Memory Database's Kubernetes Operator allows a low-privileged attacker with local access to gain complete access to all database data, with impact on other products.
Original NVD description (English source)
Vulnerability in the TimesTen In-Memory Database product of Oracle TimesTen In-Memory Database (component: Kubernetes Operator). The supported version that is affected is 26.1.1.1.0. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where TimesTen In-Memory Database executes to compromise TimesTen In-Memory Database. While the vulnerability is in TimesTen In-Memory Database, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of TimesTen In-Memory Database accessible data as well as unauthorized read access to a subset of TimesTen In-Memory Database accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of TimesTen In-Memory Database. CVSS 3.1 Base Score 5.7 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L).