CVE-2026-60401 is an easily exploitable vulnerability in Oracle TimesTen In-Memory Database (component: Kubernetes Operator) version 26.1.1.1.0. It allows a low privileged attacker who has logon access to the infrastructure where TimesTen runs to compromise the database, potentially gaining unauthorized access to critical or all accessible data. The vulnerability affects confidentiality only, with no impact on integrity or availability. The CVSS vector is AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N, reflecting local attack vector, low attack complexity, low privileges required, no user interaction, scope change, and high confidentiality impact. Oracle's July 2026 Critical Patch Update advisory mentions multiple patches but does not explicitly confirm a patch for this vulnerability. Customers are urged to stay on supported versions and apply patches promptly.

An attacker with low privileges and logon access to the infrastructure hosting TimesTen In-Memory Database can exploit this vulnerability to gain unauthorized access to critical or all data accessible by TimesTen. This compromises confidentiality significantly but does not affect data integrity or availability. The vulnerability may also impact additional products due to scope change.

Patch status is not yet confirmed — check the Oracle advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle recommends applying security patches promptly and remaining on actively supported versions. No specific temporary mitigations or workarounds are provided in the advisory.