This vulnerability in Oracle TimesTen In-Memory Database (Kubernetes Operator component) version 26.1.1.1.0 allows a low privileged attacker with logon access to the infrastructure to compromise the database by gaining unauthorized read access to a subset of accessible data. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N) indicates local attack vector, low attack complexity, low privileges required, no user interaction, scope change, and limited confidentiality impact. While the vulnerability is specific to TimesTen, it may affect other Oracle products due to scope change. Oracle has published this in their July 2026 Critical Patch Update advisory but has not explicitly stated a patch or remediation level for this specific issue. Customers are urged to stay current with Oracle patches to reduce risk.

Successful exploitation results in unauthorized read access to some data within the TimesTen In-Memory Database. There is no impact on data integrity or availability. The vulnerability requires local access with low privileges and does not require user interaction. The scope of impact may extend beyond TimesTen to other Oracle products. The overall severity is low (CVSS 3.8). No known active exploits have been reported.

Oracle has not explicitly stated a patch or remediation level for this vulnerability in the July 2026 Critical Patch Update advisory. Customers should monitor the Oracle advisory at https://www.oracle.com/security-alerts/cpujul2026.html for updates and apply Critical Patch Updates promptly when available. Until an official fix is released, limit low privileged access to the infrastructure hosting TimesTen and follow Oracle's general security recommendations for TimesTen deployments.