What is the CVSS score of CVE-2026-60402?

CVE-2026-60402 has a CVSS 3.1 base score of 9.9 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Oracle TimesTen are affected by CVE-2026-60402?

Oracle TimesTen In-Memory Database 26.1.1.1.0 can be fully compromised by attackers, with potential impact to connected business systems, because of a critical flaw in its Kubernetes Operator…

How to fix or mitigate CVE-2026-60402?

Within 24 hours, create an inventory of all TimesTen 26.1.1.1.0 deployments running with the Kubernetes Operator and assess which are internet-facing or accessible from untrusted networks. Within 7 days, restrict network access to the Kubernetes Operator component using firewall rules; implement role-based access controls for Kubernetes API interactions with TimesTen; and deploy monitoring to detect exploitation attempts against the vulnerable component. Within 30 days, establish a process to monitor Oracle Security Alerts for CVE-2026-60402 patch availability, and evaluate whether non-critical instances can be migrated to alternative solutions or taken offline pending patch release.

Oracle TimesTen CVE-2026-60402

EUVD-2026-46804 CRITICAL

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-pr5r-gwh3-wx7x

Authentication Bypass Kubernetes Oracle Timesten In Memory Database

9.9

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

9.9 CRITICAL

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

9.9 CRITICAL

Network-reachable operator API exploitable by a low-privileged account with no interaction; operator's cluster privileges yield full C/I/A and a scope change (S:C), matching a 9.9.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 03:25 vuln.today

CVE Published

Jul 21, 2026 - 22:17 nvd

CRITICAL 9.9

DescriptionCVE.org

Vulnerability in the TimesTen In-Memory Database product of Oracle TimesTen In-Memory Database (component: Kubernetes Operator). The supported version that is affected is 26.1.1.1.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTPS to compromise TimesTen In-Memory Database. While the vulnerability is in TimesTen In-Memory Database, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of TimesTen In-Memory Database. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).

Articles & Coverage 1

News Critical Privilege Escalation in Kubernetes Operator for Oracle TimesTen - CVE-2026-60402 Jul 22, 2026

AnalysisAI

Privilege-escalating takeover of Oracle TimesTen In-Memory Database 26.1.1.1.0 is possible through its Kubernetes Operator component, where a low-privileged attacker with network access over HTTPS can fully compromise the database. Because the flaw carries a scope change, successful exploitation can significantly impact additional products beyond TimesTen itself, and its 9.9 CVSS score reflects complete confidentiality, integrity, and availability loss. No public exploit identified at time of analysis, but the low attack complexity and minimal privilege requirement make it a high-priority patch item.

Technical ContextAI

Oracle TimesTen is a relational in-memory database used for latency-sensitive workloads such as telecom real-time charging, session state, and caching for the Oracle Database. The affected component is the TimesTen Kubernetes Operator, a controller that automates deployment, scaling, and lifecycle management of TimesTen instances inside Kubernetes clusters and typically holds broad cluster privileges (RBAC, secrets, service accounts). The vulnerability exposes an HTTPS-reachable interface of this operator to an authenticated but low-privileged actor. Oracle did not assign a CWE (listed N/A), so the precise root-cause class cannot be confirmed from the input; the vendor tag 'Information Disclosure' plus a full C/I/A impact and CVSS scope change suggests the operator's elevated Kubernetes permissions can be leveraged to pivot from a constrained foothold to control of the database and surrounding cluster resources.

RemediationAI

Apply the fix from the Oracle Critical Patch Update (July 2026); patch available per vendor advisory at https://www.oracle.com/security-alerts/cpujul2026.html - no discrete fixed version string was published in the input, so obtain the exact patched build directly from that CPU. Until patched, reduce exposure of the TimesTen Kubernetes Operator by restricting network reach to its HTTPS endpoint with Kubernetes NetworkPolicies so only trusted control-plane namespaces can connect (trade-off: may break legitimate automation that talks to the operator), tightening the operator's RBAC to the least privilege it needs to limit scope-change blast radius (trade-off: over-restriction can break reconciliation), and revoking or auditing low-privilege accounts that can reach the operator API since PR:L is the entry requirement. Monitor operator and API-server audit logs for anomalous requests from low-privileged principals.