Improper input validation in Oracle TimesTen In-Memory Database - CVE-2026-4176

Vulnerability identifier: #VU159888

CSH Severity: High

CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-4176

CWE-ID: CWE-20

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

The vulnerability exists due to improper input validation within the Third-party components (Perl) component in TimesTen In-Memory Database. A remote non-authenticated attacker can exploit this vulnerability to execute arbitrary code.

Oracle TimesTen In-Memory Database
Oracle Commerce Guided Search
Oracle Communications Billing and Revenue Management
Oracle Communications Cloud Native Core Security Edge Protection Proxy
Oracle Communications Cloud Native Core Policy
Oracle Communications Cloud Native Core Network Slice Selection Function
Fedora
perl-Devel-Cover
perl-PAR-Packer
perl

Install updates from vendor's website.

perl-Devel-Cover - update to 1.44-7.fc42
perl-PAR-Packer - update to 1.064-3.fc42
perl - update to 5.40.4-520.fc42

• https://www.oracle.com/security-alerts/cpujul2026.html

• Multiple vulnerabilities in Oracle Communications Cloud Native Core Security Edge Protection Proxy
• Multiple vulnerabilities in Oracle Communications Billing and Revenue Management
• Multiple vulnerabilities in Oracle Communications Cloud Native Core Policy
• Multiple vulnerabilities in Oracle Communications Cloud Native Core Network Slice Selection Function
• Multiple vulnerabilities in Oracle Commerce Guided Search
• Multiple vulnerabilities in Oracle TimesTen In-Memory Database
• Fedora 42 update for perl, perl-Devel-Cover, perl-PAR-Packer