This vulnerability affects Oracle TimesTen In-Memory Database 26.1.1.1.0, allowing a low privileged attacker who has logon access to the infrastructure where TimesTen runs to compromise the database. The vulnerability resides in the Kubernetes Operator component. Exploitation can result in unauthorized access to critical or all data accessible by TimesTen. The CVSS 3.1 vector (AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N) indicates local attack vector, high attack complexity, low privileges required, no user interaction, scope change, and high confidentiality impact without affecting integrity or availability. The vendor advisory does not explicitly confirm a patch availability for this specific vulnerability but strongly recommends applying available security patches from the July 2026 Critical Patch Update. No known exploits in the wild have been reported.

Successful exploitation can lead to unauthorized access to critical or all data accessible by the TimesTen In-Memory Database, potentially compromising confidentiality. There is no impact on data integrity or availability. The vulnerability also has a scope change, meaning it may affect additional Oracle products beyond TimesTen. The attack requires local access with low privileges and has high attack complexity, limiting ease of exploitation.

Oracle has not explicitly confirmed a patch for CVE-2026-60407 in the provided advisory content. The vendor strongly recommends that customers remain on actively supported versions and apply all available security patches from the July 2026 Critical Patch Update without delay. Since this vulnerability requires local access with low privileges, restricting infrastructure access and following Oracle's patching guidance is advised. Patch status is not yet confirmed — check the Oracle advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance.