CVE-2026-87354 in TimesTen In-Memory Database
Summary
by MITRE • 10/21/2026
Vulnerability in Oracle TimesTen In-Memory Database (component: Kubernetes Operator). Supported versions that are affected are 22.1-22.1.40.0 and 26.1-26.1.1.2.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTPS to compromise Oracle TimesTen In-Memory Database. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle TimesTen In-Memory Database accessible data. CVSS 3.1 Base Score 4.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N).
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/21/2026
The identified vulnerability resides within the Kubernetes Operator component of Oracle TimesTen In-Memory Database, specifically affecting versions ranging from 22.1 through 22.1.40.0 and 26.1 through 26.1.1.2. This security flaw is characterized by an easily exploitable condition that permits a low-privileged attacker to gain unauthorized access to the system. The attack vector requires network connectivity via HTTPS, indicating that the vulnerability can be triggered remotely over standard web protocols without requiring user interaction or complex social engineering tactics. The presence of this weakness in the Kubernetes Operator suggests a potential misconfiguration or logic error within the orchestration layer that manages database instances, rather than a direct flaw in the core database engine itself, although the impact is felt by the data stored and managed by those instances.
From a technical perspective, the vulnerability allows for unauthorized read access to a subset of accessible data within Oracle TimesTen In-Memory Database. This implies that while an attacker cannot modify or delete data, nor can they disrupt service availability through denial-of-service mechanisms in this specific instance, they are able to exfiltrate sensitive information. The restriction to low-privileged attackers is significant; it means that even users with minimal permissions within the system environment could potentially leverage this flaw to escalate their access privileges regarding data confidentiality. This aligns with common patterns where API endpoints or internal service communications lack proper authorization checks for specific resource types, allowing authenticated but unprivileged entities to query restricted datasets.
The operational impact of this vulnerability is primarily centered on data integrity and confidentiality rather than availability or system stability. The CVSS 3.1 base score of 4.3 reflects a medium severity level driven entirely by the Confidentiality metric. This means that organizations relying on Oracle TimesTen for high-performance in-memory computing must treat this as a serious risk, particularly if the database contains personally identifiable information, financial records, or other regulated data. The ability to read a subset of data could lead to competitive intelligence leaks, privacy violations under regulations such as GDPR or CCPA, and potential groundwork for further attacks where initial low-level access is used to map out more critical assets within the infrastructure.
In terms of industry standard classifications, this vulnerability maps closely to CWE-284 Improper Access Control, specifically involving insufficient authorization checks that allow lower-privileged users to perform actions reserved for higher privileges or restricted resources. Furthermore, from a tactical standpoint related to MITRE ATT&CK, this behavior is consistent with techniques found under the Discovery and Collection tactics, such as T1078 Valid Accounts if the attacker leverages legitimate credentials obtained through other means, or potentially T1530 Data from Cloud Storage Object Databases if the data exfiltration involves cloud-native storage interfaces managed by the operator. The network-based nature of the exploit places it within the Initial Access and Lateral Movement phases depending on how deeply the compromised access penetrates the cluster architecture.
Mitigation strategies should focus immediately on applying the latest security patches provided by Oracle for the affected versions, ensuring that all instances running 22.1 through 22.1.40.0 or 26.1 through 26.1.1.2 are updated to their respective patched releases. In addition to patching, organizations should review and harden access control policies within the Kubernetes cluster, ensuring that service accounts associated with the TimesTen Operator adhere strictly to the principle of least privilege. Network segmentation strategies should be implemented to restrict HTTPS traffic to the operator components only from trusted management networks or authorized application pods. Regular auditing of API server logs is recommended to detect any anomalous read operations originating from low-privileged identities, which could indicate active exploitation attempts against this vulnerability before a patch can be deployed.