[NEW] [high] Oracle TimesTen In-Memory Database: Multiple vulnerabilities

CSIRTS triage

What

Multiple vulnerabilities can compromise confidentiality, integrity, and availability.

Who is affected

Remote, anonymous, or authenticated attackers exploiting Oracle TimesTen In-Memory Database.

Urgency

Remediation is high urgency due to the potential for exploitation and the severity of the vulnerabilities.

Action

Update to the latest version of Oracle TimesTen In-Memory Database.

AI-assisted analysis generated from the source advisory — verify against the original.

Details

Source

CERT-Bund (BSI) Security Advisories (DE · national-cert · site)

Severity

high

Published

2026-07-22

Exploitation

Not in CISA KEV at last sync

Language

Machine-translated to English — verify against the original

Original advisory: https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-2434

Exploitation outlook

EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.

• Moderate exploitation riskCVE-2026-243081.2% 30-day exploitation probability. Patch within normal cadence, watch for KEV listing. Riskier than 64% of all scored CVEs.
• Low exploitation riskCVE-2026-41760.68% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 49% of all scored CVEs.
• Low exploitation riskCVE-2026-425870.99% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 59% of all scored CVEs.
• Low exploitation riskCVE-2026-604010.13% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 3% of all scored CVEs.
• Low exploitation riskCVE-2026-604020.29% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 21% of all scored CVEs.
• Low exploitation riskCVE-2026-604030.29% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 21% of all scored CVEs.
• Low exploitation riskCVE-2026-604040.39% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 32% of all scored CVEs.
• Low exploitation riskCVE-2026-604050.14% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 4% of all scored CVEs.
• Low exploitation riskCVE-2026-604060.12% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 2% of all scored CVEs.
• Low exploitation riskCVE-2026-604070.09% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 0% of all scored CVEs.

Referenced CVEs

Same CVEs, other sources

How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.

• high[NEW] [high] Atlassian Bamboo, Bitbucket, Confluence, Fisheye, Crucible, Jira and Jira Service Management: Mul…cert-bund
• high[UPDATE] [high] Atlassian Bamboo, Bitbucket, Confluence, Fisheye, Crucible, Jira and Jira Service Management: …cert-bund
• high[NEW] [high] Oracle Communications: Multiple vulnerabilitiescert-bund
• unknownMultiple vulnerabilities in IBM products (July 24, 2026)cert-fr-avis
• high[NEW] [high] Oracle Fusion Middleware: Multiple vulnerabilitiescert-bund
• unknownNCSC-2026-0258 [1.00] [M/H] Vulnerabilities fixed in Oracle Financial Servicesncsc-nl
• unknownNCSC-2026-0256 [1.00] [M/H] Vulnerabilities fixed in Oracle Communicationsncsc-nl
• unknownNCSC-2026-0255 [1.00] [M/H] Vulnerabilities fixed in Oracle Commerce Platformncsc-nl
• high[NEW] [high] Oracle Siebel CRM: Multiple vulnerabilitiescert-bund
• high[NEW] [high] Oracle Utilities Applications: Multiple vulnerabilitiescert-bund
• high[NEW] [high] Oracle Financial Services Applications: Multiple vulnerabilitiescert-bund
• high[NEW] [high] Oracle Retail Applications: Multiple vulnerabilitiescert-bund

Recent advisories for Oracle TimesTen In-Memory Database

A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.

• mediumCVE-2026-60411: Vulnerability in the TimesTen In-Memory Database product of Oracle TimesTen In-Memory Database…nvd · 2026-07-21
• mediumCVE-2026-60410: Vulnerability in the TimesTen In-Memory Database product of Oracle TimesTen In-Memory Database…nvd · 2026-07-21
• mediumCVE-2026-60409: Vulnerability in the TimesTen In-Memory Database product of Oracle TimesTen In-Memory Database…nvd · 2026-07-21
• mediumCVE-2026-60408: Vulnerability in the TimesTen In-Memory Database product of Oracle TimesTen In-Memory Database…nvd · 2026-07-21
• mediumCVE-2026-60407: Vulnerability in the TimesTen In-Memory Database product of Oracle TimesTen In-Memory Database…nvd · 2026-07-21
• mediumCVE-2026-60406: Vulnerability in the TimesTen In-Memory Database product of Oracle TimesTen In-Memory Database…nvd · 2026-07-21

More from CERT-Bund (BSI) Security Advisories

• medium[UPDATE] [medium] Linux Kernel: Multiple vulnerabilities allow denial of service2026-07-31
• medium[UPDATE] [medium] Linux Kernel: Multiple vulnerabilities allow Denial of Service2026-07-31
• medium[UPDATE] [medium] Linux Kernel: Multiple vulnerabilities allow denial of service2026-07-31
• medium[UPDATE] [medium] Linux Kernel: Multiple vulnerabilities2026-07-31
• medium[UPDATE] [medium] Linux Kernel: Multiple vulnerabilities allow unspecified attack2026-07-31