TimesTen In-Memory Database CVE-2026-60403

Exploitation requires a valid low-privileged account with network access to the TimesTen Kubernetes Operator over HTTPS; this is confirmed by CVSS PR:L and the advisory description stating 'low privileged attacker with network access via HTTPS.' The Kubernetes Operator must be deployed and reachable from the attacker's network position, which is typical in Kubernetes cluster environments where the Operator exposes an HTTPS endpoint. No special non-default configuration is described as required - any deployment of TimesTen 26.1.1.1.0 using the Kubernetes Operator component is potentially affected. Limiting factors include the requirement for at least a low-privileged credential (PR:L), meaning fully unauthenticated exploitation is not possible, and the scope is limited to the TimesTen database instance itself (S:U), preventing lateral movement to adjacent Kubernetes workloads through this vulnerability alone.

The CVSS 3.1 base score of 6.5 (Medium) reflects a pure availability impact with no confidentiality or integrity exposure. The vector AV:N/AC:L/PR:L/UI:N captures a scenario that is network-reachable, requires minimal effort, and demands only a low-privileged credential - a profile that is operationally concerning for shared or multi-tenant Kubernetes environments. EPSS data was not provided, limiting probabilistic exploitation forecasting. No KEV listing exists, and no POC has been publicly disclosed, meaning active exploitation is not confirmed. However, the low attack complexity (AC:L) means that if an attacker holds a valid low-privileged account, exploitation is likely trivial to develop or replicate independently. The scope is unchallenged (S:U), limiting blast radius to the TimesTen instance itself rather than co-hosted systems. The primary real-world risk is availability disruption in deployments where database uptime is critical, particularly in Kubernetes-managed production environments where the Operator is externally accessible. The medium CVSS score is appropriate - this is not a critical exposure, but the ease-of-exploitation warrants prompt patching in production systems.

An attacker with a valid low-privileged account - such as a developer or read-only service account in a shared Kubernetes environment - sends a specially crafted HTTPS request to the TimesTen Kubernetes Operator endpoint. The malformed request triggers a hang or crash in the TimesTen In-Memory Database process, resulting in complete availability loss for dependent applications. Because the attack is repeatable and requires no elevated privilege, an adversary can sustain a denial-of-service condition by reissuing the request each time the database recovers.