Oracle TimesTen In-Memory Database is vulnerable through its Kubernetes Operator component, allowing a low‑privileged attacker with network access via HTTPS to read a subset of the database data. The flaw results in a confidentiality impact, enabling unauthorized real‑time data disclosure. The underlying weakness is an improper access control issue, classified as CWE‑284.

The affected vendor is Oracle Corporation. The product is Oracle TimesTen In-Memory Database. Vulnerable releases include 22.1‑22.1.40.0 and 26.1‑26.1.1.2.0. Any deployment of these versions that uses the exposed Kubernetes Operator is at risk.

The CVSS 3.1 base score of 4.3 indicates a moderate severity, with a low confidentiality impact. The EPSS score of < 1% reflects a very low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog, suggesting no widespread exploitation is known. The likely attack vector is network‑based over HTTPS, requiring an attacker to have low‑privileged access to the Kubernetes Operator service. Since the attacker only needs network connectivity and basic login credentials, the exploitation is considered easy; however, the impact is limited to unauthorized read access of a subset of database data, without affecting integrity or availability.