Oracle TimesTen CVE-2026-60406

Exploitation requires the attacker to have high-privileged local logon access to the infrastructure where TimesTen In-Memory Database executes (confirmed by AV:L/PR:H in the CVSS vector). In Kubernetes-based deployments, this translates to holding a high-privilege role - such as cluster-admin or a namespace-admin binding - or having local node access where the TimesTen Kubernetes Operator pod runs. The vulnerability is specific to deployments using the Kubernetes Operator component; bare-metal or non-Kubernetes deployments of TimesTen are not implicated by the available description. No user interaction is required (UI:N). What limits exploitation: the attacker must already hold high infrastructure-level privileges, meaning exploitation is bounded to insider threats, compromised privileged accounts, or attackers who have already achieved significant lateral movement within the Kubernetes cluster. No network-based unauthenticated exploitation path is indicated.

The CVSS 3.1 base score of 6.7 (Medium) reflects a local, high-privilege-required attack (AV:L/PR:H), which meaningfully constrains the attacker population - only those with high-privileged infrastructure access can exploit this. Despite the lower base score, the impact metrics are maximum (C:H/I:H/A:H), indicating full database takeover upon successful exploitation. There is no EPSS score or KEV listing in the available data, and no public exploit has been identified, all of which reduce urgency relative to a network-exploitable, unauthenticated flaw. The real-world risk is primarily relevant to environments where privileged Kubernetes cluster access is shared broadly, insider threat models are a concern, or where privileged users are not fully trusted (e.g., managed Kubernetes environments, multi-tenant clusters). Oracle's own characterization of the vulnerability as 'easily exploitable' despite requiring high privileges is notable: once the prerequisite access level is obtained, exploitation itself poses minimal technical barrier. The tags 'Information Disclosure' and 'Kubernetes' suggest operator-level credential or secret exposure may be part of the attack surface, though this is inferred rather than confirmed by the description alone.

An attacker with high-privileged access to the Kubernetes infrastructure hosting TimesTen - such as a cluster administrator, a compromised CI/CD pipeline identity, or an insider with elevated Kubernetes role bindings - exploits the Kubernetes Operator component to escalate control over the TimesTen database instance. Because Oracle characterizes the vulnerability as 'easily exploitable' once the required access level is present, no complex chaining or bypass technique is needed. The attacker achieves full database takeover, enabling exfiltration of in-memory data, corruption of database state, or denial of service against the TimesTen instance.