What is the CVSS score of CVE-2026-60404?

CVE-2026-60404 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.4%.

TimesTen In-Memory Database CVE-2026-60404

EUVD-2026-46806 MEDIUM

Uncontrolled Resource Consumption (CWE-400)

2026-07-21 secalert_us@oracle.com

GHSA-3xpg-2xqh-fvwh

Denial Of Service Kubernetes Oracle Timesten In Memory Database

6.5

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

6.5 MEDIUM

Network HTTPS access with low credentials confirmed; no data access or code execution - pure availability impact via repeatable crash.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 09:17 vuln.today

DescriptionCVE.org

Vulnerability in the TimesTen In-Memory Database product of Oracle TimesTen In-Memory Database (component: Kubernetes Operator). The supported version that is affected is 26.1.1.1.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTPS to compromise TimesTen In-Memory Database. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of TimesTen In-Memory Database. CVSS 3.1 Base Score 6.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).

AnalysisAI

Denial-of-service in Oracle TimesTen In-Memory Database 26.1.1.1.0 allows low-privileged remote attackers to crash or hang the database via crafted HTTPS requests to the Kubernetes Operator component. The vulnerability is network-accessible with low complexity, requiring only low-level credentials, and results in complete availability loss with no confidentiality or integrity impact. No public exploit code or CISA KEV listing has been identified at time of analysis, but Oracle has disclosed this through the July 2026 Critical Patch Update.

Technical ContextAI

Oracle TimesTen In-Memory Database is a commercial in-memory relational database optimized for low-latency OLTP workloads. The affected component is the Kubernetes Operator, a controller-pattern deployment tool that manages TimesTen instances within Kubernetes clusters - handling lifecycle operations such as provisioning, scaling, and health management of database pods. The attack surface is the HTTPS interface exposed by this operator. No CWE is assigned in the advisory, so the precise root cause class (e.g., resource exhaustion, null dereference, or logic error leading to crash) cannot be determined from available data. The affected version is 26.1.1.1.0, as identified by Oracle's advisory and the EUVD entry EUVD-2026-46806.

RemediationAI

Apply the patch released as part of Oracle's July 2026 Critical Patch Update, available at https://www.oracle.com/security-alerts/cpujul2026.html. An exact fixed version number is not independently confirmed from the available data beyond the advisory reference - consult the CPU directly for the patched release identifier. As a compensating control prior to patching, restrict network access to the Kubernetes Operator's HTTPS interface using Kubernetes NetworkPolicy or ingress firewall rules, limiting connectivity to trusted management hosts and service accounts only. Additionally, enforce least-privilege RBAC within the Kubernetes cluster to limit which accounts can interact with the TimesTen Operator API. Note that tightening RBAC may affect automated deployment and scaling workflows that rely on low-privilege service tokens. No workaround fully eliminates the risk without patching.