This vulnerability affects Oracle TimesTen In-Memory Database component Kubernetes Operator in version 26.1.1.1.0. It enables a low privileged attacker with network access over HTTPS to compromise the database, resulting in full takeover. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) reflects network attack vector, low attack complexity, low privileges required, no user interaction, scope change, and high impact on confidentiality, integrity, and availability. The vulnerability may also affect additional Oracle products due to scope change. Oracle's July 2026 Critical Patch Update advisory mentions multiple security patches but does not explicitly confirm a patch for this vulnerability. No known exploits in the wild have been reported to date.

Successful exploitation allows an attacker with low privileges and network access via HTTPS to take over the TimesTen In-Memory Database, compromising confidentiality, integrity, and availability. Due to scope change, additional Oracle products may also be significantly impacted. This represents a critical risk to affected environments.

Oracle's July 2026 Critical Patch Update advisory references this vulnerability but does not explicitly confirm patch availability for TimesTen In-Memory Database version 26.1.1.1.0. Patch status is not yet confirmed — users should consult the Oracle advisory at https://www.oracle.com/security-alerts/cpujul2026.html for the latest remediation guidance. Oracle strongly recommends applying security patches promptly once available and remaining on actively supported versions. Until a patch is confirmed, restrict network access to the TimesTen In-Memory Database and monitor Oracle advisories closely.