CVE-2026-60403 is a medium severity vulnerability in Oracle TimesTen In-Memory Database 26.1.1.1.0, specifically in the Kubernetes Operator component. It permits a low privileged attacker with network access over HTTPS to cause a denial of service by hanging or crashing the database. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, no confidentiality or integrity impact, but high availability impact. The vendor advisory from Oracle's July 2026 Critical Patch Update does not explicitly mention a patch for this vulnerability, and no patch links are provided. Oracle recommends applying security patches promptly but has not confirmed a fix for this issue yet.

Successful exploitation allows an attacker with low privileges and network access via HTTPS to cause a hang or repeated crash of the TimesTen In-Memory Database, resulting in a complete denial of service. There is no impact on confidentiality or integrity, only availability is affected.

Patch status is not yet confirmed — check the Oracle advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle recommends applying security patches promptly when available and staying on actively supported versions. Until a patch is released, consider limiting network access to the TimesTen In-Memory Database's HTTPS interface to trusted users only.