The vulnerability in Oracle TimesTen In-Memory Database permits a user who has logged onto the host where the database runs to perform unauthorized modifications—insert, update, or delete—on data as well as read restricted information. Although the impact is limited to the data sets that the compromised process can access, it can still compromise confidentiality and integrity controls established by the database administrator. The weakness is an improper access control flaw that allows privilege escalation from a low‑level local account.

Affected products are Oracle TimesTen In-Memory Database versions 26.1 and 26.1.1.3.0, distributed by Oracle Corporation. The vulnerability affects all deployment configurations where the database runs with any user‑level account that can log into the underlying operating system. No other versions or components were identified as impacted.

The CVSS Base score of 3.6 reflects a low‑severity risk in the initial baseline, with local access and high attack complexity limiting the exploitation surface. The EPSS metric is currently unavailable, and the issue is not listed in the CISA KEV catalog, indicating no known widespread exploitation. Attackers would need local logon privileges, but once entered they can bypass the database’s authorization checks to affect the integrity of sensitive data or expose it to unauthorized readers. While the risk is modest, it remains non‑negligible for environments that rely heavily on strict data protection and least‑privilege enforcement.