CVE-2026-60411 affects Oracle TimesTen In-Memory Database component ttcserver, specifically version 26.1.1.1.0. An unauthenticated attacker with physical access to the communication segment attached to the hardware running TimesTen can exploit this vulnerability to cause a hang or frequent crashes, resulting in a complete denial of service. The vulnerability is classified under CWE-400 (Uncontrolled Resource Consumption). The CVSS vector indicates attack complexity is low, no privileges or user interaction required, but the attacker must have access to the physical communication segment (attack vector: adjacent). The impact is limited to availability with no confidentiality or integrity impact. Oracle's July 2026 Critical Patch Update advisory mentions this vulnerability but does not explicitly confirm a patch or remediation level for it. Customers are advised to stay on supported versions and apply patches as they become available.

Successful exploitation results in denial of service by causing the TimesTen In-Memory Database to hang or crash repeatedly. There is no impact on confidentiality or integrity. The attack requires physical access to the communication segment attached to the hardware, limiting remote exploitation. The vulnerability could disrupt database availability, affecting dependent applications or services.

Patch status is not yet confirmed — check the Oracle advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle recommends applying Critical Patch Updates promptly and remaining on actively supported versions. Since no explicit patch or temporary fix is stated for this vulnerability, monitor Oracle advisories for updates. Restrict physical access to the communication segments attached to the hardware running TimesTen to reduce exposure.