What is the CVSS score of CVE-2026-60145?

CVE-2026-60145 has a CVSS 3.1 base score of 4.9 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.4%.

Is there a patch available for CVE-2026-60145?

Yes, a patch is available for CVE-2026-60145. Update the affected software to the latest version immediately.

Oracle MySQL CVE-2026-60145

EUVD-2026-46553 MEDIUM

Improper Access Control (CWE-284)

2026-07-21 oracle

GHSA-r62r-4vf9-gc43

Oracle Mysql Server Mysql Cluster Authentication Bypass Red Hat Suse

4.9

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

4.9 MEDIUM

AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

4.9 MEDIUM

Network-reachable via multiple protocols but requires high-privilege database credentials (PR:H); impact is exclusively availability (A:H) with no confidentiality or integrity effect and no scope change.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

SUSE

MEDIUM

qualitative

Red Hat

4.9 MEDIUM

qualitative

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 02:30 vuln.today

CVE Published

Jul 21, 2026 - 21:33 nvd

MEDIUM 4.9

DescriptionCVE.org

Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and 9.7.0-9.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).

AnalysisAI

MySQL Server and MySQL Cluster's Optimizer component can be crashed or hung by a high-privileged attacker with network access, resulting in complete denial of service. Affected deployments span MySQL Server 8.4.0-8.4.10 and 9.7.0-9.7.1, as well as MySQL Cluster 8.0.0-8.0.47, 8.4.0-8.4.10, and 9.7.0-9.7.1, per Oracle's July 2026 Critical Patch Update. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog, making real-world exploitation contingent on access to high-privileged database credentials.

Technical ContextAI

The vulnerable component is the MySQL Server Optimizer - the subsystem responsible for parsing, planning, and selecting efficient execution strategies for SQL queries. Flaws in optimizer logic commonly manifest as infinite loops, assertion failures, or unhandled edge cases when processing specially crafted or pathological query constructs, leading to server hangs or repeatable crashes. CPE identifiers cpe:2.3:a:oracle_corporation:mysql_server and cpe:2.3:a:oracle_corporation:mysql_cluster confirm that both the standard server and the NDB Cluster variant (which adds distributed storage and high-availability semantics) are affected. The CVSS vector AV:N reflects that MySQL's native protocol and administrative interfaces are network-exposed, while PR:H indicates exploitation requires a user with elevated database privileges. No CWE has been assigned by the reporter, which limits root-cause classification; however, the hang-or-crash impact pattern is consistent with CWE-835 (Loop with Unreachable Exit Condition) or CWE-617 (Reachable Assertion) in optimizer code paths.

RemediationAI

Apply the Oracle Critical Patch Update (CPU) for July 2026, available at https://www.oracle.com/security-alerts/cpujul2026.html. Patch available per vendor advisory; exact fixed version numbers for MySQL Server and MySQL Cluster should be confirmed directly from the Oracle advisory, as specific patched release identifiers are not independently confirmed in the available input data. As a compensating control where immediate patching is not feasible, restrict network access to MySQL ports (default 3306/TCP for MySQL Server; 1186/TCP for NDB Cluster management) to only trusted application hosts and administrative subnets using firewall rules - note this may require application connectivity adjustments. Additionally, audit and minimize the set of accounts holding high-privileged database roles (such as SUPER or SYSTEM_VARIABLES_ADMIN), since only high-privilege accounts can trigger this vulnerability; reducing the privileged account surface directly limits exploitability. Revoking unnecessary elevated grants has no functional impact on standard application database accounts.