What is the CVSS score of CVE-2026-60163?

CVE-2026-60163 has a CVSS 3.1 base score of 8.4 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of MySQL Server are affected by CVE-2026-60163?

A critical vulnerability in Oracle MySQL Server and Cluster (versions 8.4.0-8.4.10 and 9.7.0-9.7.1) enables complete database compromise through the Group Replication Plugin by any user with local…. A patch is available.

How to fix or mitigate CVE-2026-60163?

Within 24 hours: Inventory all MySQL Server and Cluster instances running versions 8.4.0-8.4.10 or 9.7.0-9.7.1; audit local system access permissions and disable the Group Replication Plugin if not operationally critical. Within 7 days: Implement OS-level access controls restricting local logon to database servers and enable comprehensive audit logging for database system activities; document all systems requiring Group Replication and develop risk acceptance records for those instances. Within 30 days: Monitor Oracle security advisories for patch release; test and stage upgraded MySQL versions in non-production environments; schedule maintenance windows for patching all affected production systems immediately upon vendor release.

MySQL Server CVE-2026-60163

EUVD-2026-46569 HIGH

Improper Access Control (CWE-284)

2026-07-21 oracle

GHSA-r8hj-8qqf-f8wc

Authentication Bypass Oracle Mysql Cluster Mysql Server Oracle Corporation

8.4

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.4 HIGH

AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.4 HIGH

AV:L and PR:N reflect Oracle's 'unauthenticated attacker with host logon' framing; low complexity and full takeover justify C:H/I:H/A:H with unchanged scope.

3.1 AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

HIGH

qualitative

Red Hat

8.4 HIGH

qualitative

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 21, 2026 - 23:10 vuln.today

CVE Published

Jul 21, 2026 - 21:33 nvd

HIGH 8.4

DescriptionCVE.org

Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Group Replication Plugin). Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and 9.7.0-9.7.1. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where MySQL Server, MySQL Cluster executes to compromise MySQL Server, MySQL Cluster. Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 8.4 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Full takeover of Oracle MySQL Server and MySQL Cluster is possible through the Server: Group Replication Plugin, where a local attacker holding only a logon to the host running the database can compromise the instance without any database credentials. The flaw affects MySQL Server 8.4.0-8.4.10 and 9.7.0-9.7.1, plus MySQL Cluster 8.0.0-8.0.47, 8.4.0-8.4.10 and 9.7.0-9.7.1, and carries a CVSS 3.1 base score of 8.4 with high confidentiality, integrity and availability impact. No public exploit identified at time of analysis and the issue is not listed in CISA KEV.

Technical ContextAI

The vulnerability resides in the Group Replication Plugin, the MySQL component that provides multi-primary/single-primary fault-tolerant replication built on a group communication (Paxos-based) engine. This plugin is only active in deployments configured for Group Replication clustering, which is common in MySQL InnoDB Cluster and MySQL Cluster high-availability topologies. Oracle assigned no CWE (CWE: N/A), so the precise root-cause class is not specified in the available data; the combined confidentiality, integrity and availability impact together with 'takeover' phrasing is consistent with a memory-safety or logic flaw in the plugin's message/state handling rather than a pure information-disclosure bug, despite the 'Information Disclosure' tag. The affected products are identified by CPE cpe:2.3:a:oracle_corporation:mysql_server and cpe:2.3:a:oracle_corporation:mysql_cluster.

RemediationAI

Patch available per vendor advisory: apply the fixes from the Oracle Critical Patch Update of July 2026 (https://www.oracle.com/security-alerts/cpujul2026.html) by upgrading MySQL Server and MySQL Cluster to the corrected releases above the affected ranges (8.4.x, 9.7.x, and Cluster 8.0.x) as specified in the CPU; exact fixed build numbers should be taken from that advisory rather than assumed. Where immediate patching is not possible, the most effective compensating control is to restrict and audit host logon access to database servers, since exploitation requires an interactive/local logon to the infrastructure - enforce least-privilege OS accounts, remove shared or unnecessary local accounts, and isolate database hosts from general-purpose or multi-tenant shells. If Group Replication is not required for a given deployment, disabling the Group Replication Plugin removes the attack surface, at the cost of losing the high-availability/replication cluster functionality; do not disable it on production clusters that depend on it.