EUVD-2026-46808
GHSA-mm7x-2679-qrgg
Severity by source
AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Local vector and high privileges confirmed by description (logon to infrastructure required); full C/I/A impact consistent with database takeover; no scope change as the compromise is contained to the TimesTen instance.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
Lifecycle Timeline
1DescriptionCVE.org
Vulnerability in the TimesTen In-Memory Database product of Oracle TimesTen In-Memory Database (component: Kubernetes Operator). The supported version that is affected is 26.1.1.1.0. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where TimesTen In-Memory Database executes to compromise TimesTen In-Memory Database. Successful attacks of this vulnerability can result in takeover of TimesTen In-Memory Database. CVSS 3.1 Base Score 6.7 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).
AnalysisAI
Full takeover of Oracle TimesTen In-Memory Database 26.1.1.1.0 is achievable by a high-privileged attacker with local logon access to the infrastructure through a flaw in the Kubernetes Operator component. The attack requires no user interaction and is characterized by Oracle as 'easily exploitable,' resulting in complete compromise of confidentiality, integrity, and availability. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Technical ContextAI
Oracle TimesTen In-Memory Database is a high-performance, relational in-memory database designed for ultra-low latency workloads, typically deployed in telecommunications, financial services, and real-time analytics environments. The affected component is the Kubernetes Operator - a software extension that automates the deployment, scaling, and management of TimesTen instances within Kubernetes clusters. Operators in Kubernetes run with elevated cluster privileges to manage Custom Resources (CRDs), and a flaw here can allow an attacker with existing high-privileged infrastructure access to abuse operator capabilities to gain full control over managed database instances. No CWE has been assigned in the available data, making the precise root cause class (e.g., privilege escalation, insecure credential handling, RBAC misconfiguration, or command injection within the operator) unconfirmed. The CVSS vector AV:L confirms this is a local attack surface, consistent with operator-level access to the Kubernetes node or control plane. The affected version is 26.1.1.1.0 as identified in EUVD-2026-46808.
RemediationAI
Apply the patch issued as part of Oracle's Critical Patch Update for July 2026, available via the Oracle advisory at https://www.oracle.com/security-alerts/cpujul2026.html. The exact patched version number is not independently confirmed in the available data beyond the advisory reference - consult Oracle Support for the specific upgrade target version. As a compensating control prior to patching, restrict Kubernetes RBAC permissions on the TimesTen Operator service account to the minimum required, and audit which users or service accounts hold cluster-admin or operator-level roles in the affected namespace. Implementing Kubernetes namespace isolation and network policies can limit lateral movement from a compromised operator. Note that tightening RBAC may impact the operator's ability to manage database lifecycle operations and should be tested before applying in production. No workarounds are specified by Oracle in the available advisory data.
More in Kubernetes
View allA critical vulnerability in Kubernetes ingress-nginx controller allows unauthenticated attackers with pod network access
Credential-harvesting malware compromised 84 versions of 42 TanStack npm packages on 2026-05-11 via chained GitHub Actio
Kubernetes ingress-nginx contains a configuration injection vulnerability via the mirror-target and mirror-host Ingress
A security issue was discovered in ingress-nginx https://github.com/kubernetes/ingress-nginx where the `auth-url` Ingres
A security issue was discovered in ingress-nginx https://github.com/kubernetes/ingress-nginx where the `auth-tls-match-c
Kubernetes API server in all versions allow an attacker who is able to create a ClusterIP service and set the spec.exter
A security issue was discovered in Kubernetes where a user that can create pods on Windows nodes may be able to escalate
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Rated critical severity (CVSS 9.9), this vulne
Unauthenticated remote attackers can trigger complete database overwrites, server-side file reads, and SSRF attacks agai
The Kubernetes integration in GitLab Enterprise Edition 11.x before 11.2.8, 11.3.x before 11.3.9, and 11.4.x before 11.4
Fluentd configuration injection in the kube-logging Logging operator before 6.6.0 allows a namespace-scoped user who can
Kyverno Kubernetes policy engine prior to 1.x has a privilege escalation vulnerability (CVSS 9.9) allowing policy bypass
Same weakness CWE-269 – Improper Privilege Management
View allSame technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today