This vulnerability exists in Oracle TimesTen In-Memory Database component Kubernetes Operator, specifically in version 26.1.1.1.0. It is exploitable by an attacker with high privileges and logon access to the infrastructure hosting the database. The vulnerability allows unauthorized modification and reading of some accessible data and can cause partial denial of service. The CVSS 3.1 vector indicates local attack vector, low attack complexity, high privileges required, no user interaction, and scope change affecting confidentiality, integrity, and availability with low impact on confidentiality and integrity and low impact on availability. Oracle has published this vulnerability in their July 2026 Critical Patch Update advisory but has not explicitly confirmed a patch or remediation level for this specific issue. Customers are urged to stay current with Oracle patches.

An attacker with high privileges and logon access to the infrastructure can exploit this vulnerability to gain unauthorized read and write access to some data in the TimesTen In-Memory Database. This includes the ability to update, insert, or delete data. Additionally, the attacker can cause a partial denial of service affecting the availability of the database. The vulnerability impacts confidentiality, integrity, and availability but with limited severity as indicated by the CVSS score of 5.7.

Patch status is not yet confirmed — check the vendor advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle strongly recommends applying Critical Patch Updates promptly and remaining on actively supported versions to mitigate this and other vulnerabilities. No specific temporary mitigations or workarounds are provided in the advisory.