Oracle MySQL CVE-2026-60145

Exploitation requires possession of a high-privileged MySQL account (CVSS PR:H) with network connectivity to the MySQL Server or Cluster instance on any supported protocol (the description explicitly states 'multiple protocols', encompassing MySQL native protocol, X Protocol, and administrative interfaces). The vulnerability resides in the Optimizer component, implying exploitation is achieved via crafted SQL query submission - no special server configuration flag or non-default feature enablement is indicated as a prerequisite beyond having a high-privilege session. Exploitation is strictly limited by the high privilege requirement: standard low-privilege application users or read-only accounts cannot trigger this flaw. Network-level controls (firewall rules, VPC segmentation) that restrict MySQL port exposure to trusted hosts further constrain the attacker's ability to reach the service even with valid credentials.

The CVSS 3.1 score of 4.9 (Medium) accurately reflects the constrained exploitability: the attack vector is network-accessible (AV:N) with low complexity (AC:L) and no user interaction (UI:N), but the high privilege requirement (PR:H) is the dominant risk-limiting factor. Only users with DBA-level or equivalent elevated database grants can trigger the vulnerability, substantially narrowing the attacker population. Impact is exclusively availability (A:H, C:N, I:N), so successful exploitation cannot directly lead to data exfiltration or modification - this is a pure availability disruption. No EPSS score was provided in the available data, so probabilistic exploitation likelihood cannot be quantified. The vulnerability is absent from the CISA KEV catalog and no public exploit code has been identified, further reducing urgency. Real-world risk is most meaningful in scenarios involving insider threat, compromised privileged database accounts, or multi-tenant database environments where tenant accounts carry elevated grants. For organizations with strict privilege separation and network segmentation around MySQL ports, the practical exploitability is low despite the network-accessible vector.

A high-privileged MySQL user - such as a DBA account, a monitoring agent with elevated grants, or an application service account with excessive privileges - connects to the MySQL Server or Cluster instance over the network and submits a crafted SQL query designed to trigger a pathological code path in the Optimizer component. The server enters a hang state or crashes repeatedly, disrupting all client connections and causing complete database unavailability until the service is manually restarted. No public exploit code has been identified, making this scenario most relevant to insider threat actors or attackers who have already compromised privileged database credentials through phishing, credential stuffing, or lateral movement.