EUVD-2026-46804
GHSA-pr5r-gwh3-wx7x
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privileged cluster foothold
-
DeliveryReach operator HTTPS endpoint
-
ExploitSend crafted request to Kubernetes Operator
-
ExecutionAbuse operator's elevated permissions
-
PersistTake over TimesTen database
-
ImpactPivot to adjacent cluster resources (scope change)
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network access to the TimesTen Kubernetes Operator's HTTPS interface and a low-privileged authenticated identity (CVSS PR:L) - not a fully unauthenticated attacker, which is the primary limiting factor. The affected deployment mode is specifically TimesTen In-Memory Database 26.1.1.1.0 running under its Kubernetes Operator; environments that do not use the Kubernetes Operator for TimesTen are not in scope. No user interaction is needed (UI:N) and attack complexity is low (AC:L), so once an attacker holds any low-privilege credential with HTTPS reachability to the operator, no further special configuration is required. The scope change (S:C) means impact is not confined to the database process, raising realistic risk in shared clusters. |
| Impact | The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, 9.9) signals a genuinely severe, easily exploitable network flaw: no user interaction, low complexity, only low privileges required, and a scope change indicating blast radius beyond the vulnerable component. This is not a high-score-but-low-real-risk case - the combination of low PR, network vector, and scope change is exactly the profile that enables lateral movement in container environments. However, key corroborating signals are missing: no EPSS score, KEV status, or POC availability was provided in the input, so real-world exploitation likelihood cannot be quantified. The vendor 'Information Disclosure' tag understates the rated full C/I/A takeover, a discrepancy worth noting; treat the higher CVSS impact as authoritative. Absence of KEV/POC data means this is currently a pre-exploitation, patch-now priority rather than confirmed active abuse. |
| Exploit ScenarioDerived | An attacker who has obtained a low-privileged account or foothold able to reach the TimesTen Kubernetes Operator's HTTPS interface sends a crafted request that abuses the operator's elevated cluster permissions. With no user interaction and low complexity, they escalate to full control of the TimesTen database and, via the scope change, pivot to adjacent Kubernetes resources such as secrets and other workloads. No public exploit identified at time of analysis, so this reflects the CVSS-derived attack profile rather than an observed campaign. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 22, 2026
Privilege-escalating takeover of Oracle TimesTen In-Memory Database 26.1.1.1.0 is possible through its Kubernetes Operator component, where a low-privileged attacker with network access over HTTPS can fully compromise the database. Because the flaw carries a scope change, successful exploitation can significantly impact additional products beyond TimesTen itself, and its 9.9 CVSS score reflects complete confidentiality, integrity, and availability loss. No public exploit identified at time of analysis, but the low attack complexity and minimal privilege requirement make it a high-priority patch item.
RemediationAI
Apply the fix from the Oracle Critical Patch Update (July 2026); patch available per vendor advisory at https://www.oracle.com/security-alerts/cpujul2026.html - no discrete fixed version string was published in the input, so obtain the exact patched build directly from that CPU. Until patched, reduce exposure of the TimesTen Kubernetes Operator by restricting network reach to its HTTPS endpoint with Kubernetes NetworkPolicies so only trusted control-plane namespaces can connect (trade-off: may break legitimate automation that talks to the operator), tightening the operator's RBAC to the least privilege it needs to limit scope-change blast radius (trade-off: over-restriction can break reconciliation), and revoking or auditing low-privilege accounts that can reach the operator API since PR:L is the entry requirement. Monitor operator and API-server audit logs for anomalous requests from low-privileged principals.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Oracle TimesTen is a relational in-memory database used for latency-sensitive workloads such as telecom real-time charging, session state, and caching for the Oracle Database. The affected component is the TimesTen Kubernetes Operator, a controller that automates deployment, scaling, and lifecycle management of TimesTen instances inside Kubernetes clusters and typically holds broad cluster privileges (RBAC, secrets, service accounts). The vulnerability exposes an HTTPS-reachable interface of this operator to an authenticated but low-privileged actor. Oracle did not assign a CWE (listed N/A), so the precise root-cause class cannot be confirmed from the input; the vendor tag 'Information Disclosure' plus a full C/I/A impact and CVSS scope change suggests the operator's elevated Kubernetes permissions can be leveraged to pivot from a constrained foothold to control of the database and surrounding cluster resources.
Know when Kubernetes gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Network-reachable operator API exploitable by a low-privileged account with no interaction; operator's cluster privileges yield full C/I/A and a scope change (S:C), matching a 9.9.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the TimesTen In-Memory Database product of Oracle TimesTen In-Memory Database (component: Kubernetes Operator). The supported version that is affected is 26.1.1.1.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTPS to compromise TimesTen In-Memory Database. While the vulnerability is in TimesTen In-Memory Database, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of TimesTen In-Memory Database. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).
Articles & Coverage 1
Executive ViewAI
Oracle TimesTen In-Memory Database 26.1.1.1.0 can be fully compromised by attackers, with potential impact to connected business systems, because of a critical flaw in its Kubernetes Operator component. Organizations running this version have no vendor-released patch available, creating immediate and ongoing risk to data security and system availability. The absence of remediation options makes this a priority incident for database and infrastructure teams.
No vendor-released patch identified at time of analysis. Interim mitigations: restrict HTTPS network access to the Kubernetes Operator to authorized sources only; implement network segmentation to isolate TimesTen instances from broader infrastructure; restrict Kubernetes API permissions to minimal required privileges; enable comprehensive logging of all Operator component interactions; disable the Kubernetes Operator if operationally feasible; consider migrating to non-Kubernetes deployment models if operationally feasible; maintain enhanced monitoring and logging for threat detection.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Kubernetes
View allA critical vulnerability in Kubernetes ingress-nginx controller allows unauthenticated attackers with pod network access
Credential-harvesting malware compromised 84 versions of 42 TanStack npm packages on 2026-05-11 via chained GitHub Actio
Kubernetes ingress-nginx contains a configuration injection vulnerability via the mirror-target and mirror-host Ingress
A security issue was discovered in ingress-nginx https://github.com/kubernetes/ingress-nginx where the `auth-url` Ingres
A security issue was discovered in ingress-nginx https://github.com/kubernetes/ingress-nginx where the `auth-tls-match-c
Kubernetes API server in all versions allow an attacker who is able to create a ClusterIP service and set the spec.exter
A security issue was discovered in Kubernetes where a user that can create pods on Windows nodes may be able to escalate
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Rated critical severity (CVSS 9.9), this vulne
Unauthenticated remote attackers can trigger complete database overwrites, server-side file reads, and SSRF attacks agai
The Kubernetes integration in GitLab Enterprise Edition 11.x before 11.2.8, 11.3.x before 11.3.9, and 11.4.x before 11.4
Fluentd configuration injection in the kube-logging Logging operator before 6.6.0 allows a namespace-scoped user who can
Authenticated Typebot users can abuse the webhook block (HTTP Request component) in versions prior to 3.13.1 to issue ar
Exploit-DB