CVE-2026-60404 Oracle Corporation CVE debrief

Who should care

Organizations using Oracle TimesTen In-Memory Database version 26.1.1.1.0 should be aware of this vulnerability and take necessary actions to remediate it. This includes reviewing and applying patches or updates provided by Oracle, implementing compensating controls, and monitoring for potential attacks. Operators and security teams responsible for managing and securing TimesTen In-Memory Database deployments should prioritize this vulnerability due to its potential impact on availability.

Technical summary

The CVE-2026-60404 vulnerability is in the Kubernetes Operator component of Oracle TimesTen In-Memory Database version 26.1.1.1.0. A low-privileged attacker with network access via HTTPS can exploit this vulnerability to cause a hang or frequently repeatable crash (complete DOS) of TimesTen In-Memory Database. The CVSS 3.1 Base Score is 6.5 (Availability impacts), with the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H. The vulnerability allows unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of TimesTen In-Memory Database.

Defensive priority

Medium priority given the CVSS score of 6.5 and the potential for a hang or frequently repeatable crash (complete DOS) of TimesTen In-Memory Database.

Recommended defensive actions

• Inventory and verify the version of TimesTen In-Memory Database to check for vulnerability
• Apply patches or updates provided by Oracle to remediate the vulnerability
• Implement compensating controls such as monitoring and exception tracking
• Restrict network access to the database to minimize the attack surface
• Review and update security configurations to prevent similar vulnerabilities
• Monitor relevant logs and detection systems for exposed assets
• Track exceptions and retest remediated assets

Evidence notes

The CVE-2026-60404 vulnerability affects Oracle TimesTen In-Memory Database version 26.1.1.1.0. It allows a low-privileged attacker with network access via HTTPS to compromise the database, potentially causing a hang or crash. The CVSS 3.1 Base Score is 6.5, indicating a medium severity. The vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H.

Official resources