EUVD-2026-105935
GHSA-x5vv-2569-qq7g
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privileged local logon on database host
-
ExploitExploit TimesTen IMDB confidentiality flaw
-
ExecutionRead unauthorized critical database data
-
ImpactExfiltrate sensitive data
Vulnerability Assessment
| Exploitation Conditions | Exploitation requires the attacker to already possess local logon access to the infrastructure running Oracle TimesTen In-Memory Database AND hold low-level privileges (PR:L, AV:L) on that host - there is no network-reachable attack path. Affected deployments are Oracle TimesTen In-Memory Database versions 22.1 through 22.1.1.43.0. No special non-default feature or configuration is named in the description. The limiting factors that reduce real-world risk are the mandatory local presence and pre-existing authenticated foothold; impact is confined to unauthorized reading of data (confidentiality only), with no integrity or availability effect. |
| Impact | This is a moderate-severity, local-access vulnerability, not an urgent priority. The CVSS 3.1 vector (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, base 5.5) shows the critical limiting factor: AV:L means the attacker must already have local logon access to the host running Oracle TimesTen, and PR:L means they must already hold low-level privileges - so this is a privilege-to-data escalation, not a remotely reachable flaw. Impact is confidentiality-only (C:H, I:N, A:N): an attacker can read all data accessible to the database but cannot modify it or cause denial of service. No EPSS score, KEV listing, or POC was provided in the input, so there is no signal of active or probable exploitation - exploitation status is 'no public exploit identified at time of analysis.' A notable conflict: the input Tags include 'Authentication Bypass,' which contradicts the CVSS vector requiring prior authentication/privileges (PR:L) and local logon; this flaw is a local confidentiality compromise by an already-authenticated low-privileged user, not an authentication bypass. Treat the tag as suspect and verify against Oracle's October 2026 CPU. |
| Exploit ScenarioDerived | An attacker who already has a low-privileged local account on the server hosting Oracle TimesTen In-Memory Database (e.g., a limited OS user or a low-tier database account) leverages the flaw to read data they should not have access to, resulting in unauthorized disclosure of critical or all database-accessible data. Because AC:L and PR:L, exploitation is straightforward once local footholds exist, but no user interaction and no network path are involved. No public exploit code was identified in the provided intelligence. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Local users with only low-level logon privileges on a host running Oracle TimesTen In-Memory Database 22.1 through 22.1.1.43.0 can read critical database contents they are not entitled to see, giving them complete read access to all TimesTen data reachable from that instance. The flaw is easily triggered once an attacker already holds a foothold on the machine (AV:L/PR:L, no user interaction) but cannot be reached over the network, and it affects confidentiality only - no writes, corruption, or service disruption. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the vendor has published a fix through the October 2026 Critical Patch Update.
RemediationAI
Apply the October 2026 Oracle Critical Patch Update, which is the vendor's fix vehicle for this CVE (https://www.oracle.com/security-alerts/cpuoct2026.html); the exact patched TimesTen build number is not stated in the available data, so confirm the target release with Oracle Support or the CPU patch availability matrix before upgrading, and plan a maintenance window because TimesTen upgrades require stopping the instance and its replication agents. If the upgrade cannot be staged immediately, the primary compensating control is to shrink who can log on locally to the database hosts: restrict interactive and batch access to the TimesTen instance owner account and a named DBA group, and remove shell access for application and reporting accounts, at the cost of extra operational overhead for troubleshooting and support. Harden the OS-level boundary around the instance by ensuring the data store directories, daemon configuration, and shared-memory segments are readable only by the instance owner (tightening directory and file permissions may break third-party utilities that run under different accounts). Enforce least privilege inside the database itself by mapping application users to restricted TimesTen external users or PL/SQL access-control roles instead of granting broad object privileges, accepting that legacy applications relying on OS-user authentication may need re-configuration. Finally, enable TimesTen and operating-system audit logging on the instance and alert on unusual local sessions or mass reads of sensitive tables, which provides detection but not prevention, and treat loss of those logs as a gap rather than a mitigation.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Oracle TimesTen In-Memory Database is a memory-optimized relational database used as a low-latency transactional tier, frequently embedded in Oracle Communications, retail, and telecom stacks or deployed as a cache in front of Oracle Database. Because the instance runs as a local server process that clients reach over shared memory or a local listener, the security boundary for this issue sits at the operating-system and database privilege layer rather than at the network perimeter. The CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) describes a component whose access checks fail to constrain what an already-authenticated, low-privileged local user can read: exploitation is deterministic (AC:L), needs no victim interaction, and crosses a confidentiality boundary to expose all data the TimesTen instance can reach, while integrity and availability remain untouched. No CWE identifier was published with the CVE, but the observable behavior maps to the improper access control / exposure-of-sensitive-information class. The vendor-supplied tag 'Authentication Bypass' suggests the weakness may let a legitimate local account sidestep expected authorization checks against the data store, which is consistent with the high confidentiality rating combined with a low privilege requirement; because the vector is PR:L, this remains a post-authentication local issue rather than an anonymous one.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Description states local logon and low privileges required (AV:L, PR:L), easily exploitable (AC:L), no user interaction, and confidentiality-only impact (C:H, I:N, A:N).
Primary rating from NVD.
CVSS VectorNVD
DescriptionNVD
Vulnerability in Oracle TimesTen In-Memory Database (component: TimesTen IMDB). Supported versions that are affected are 22.1-22.1.1.43.0. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle TimesTen In-Memory Database executes to compromise Oracle TimesTen In-Memory Database. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle TimesTen In-Memory Database accessible data. CVSS 3.1 Base Score 5.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB