What is the CVSS score of CVE-2026-60177?

CVE-2026-60177 has a CVSS 3.1 base score of 4.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.3%.

Is there a patch available for CVE-2026-60177?

Yes, a patch is available for CVE-2026-60177. Update the affected software to the latest version immediately.

MySQL Server CVE-2026-60177

EUVD-2026-46583 MEDIUM

Uncontrolled Resource Consumption (CWE-400)

2026-07-21 oracle

GHSA-hmxm-xx78-7639

Denial Of Service Oracle Mysql Server Mysql Cluster Red Hat Suse

4.4

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

4.4 MEDIUM

AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

4.4 MEDIUM

Network vector and high privileges confirmed by description; AC:H reflects difficult exploitation; impact is availability-only with no confidentiality or integrity loss.

3.1 AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:H/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

SUSE

MEDIUM

qualitative

Red Hat

4.4 MEDIUM

qualitative

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

High

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 02:19 vuln.today

CVE Published

Jul 21, 2026 - 21:33 nvd

MEDIUM 4.4

DescriptionCVE.org

Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Clone Plugin). Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and 9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H).

AnalysisAI

Denial-of-service in Oracle MySQL Server and MySQL Cluster's Clone Plugin allows a high-privileged, network-connected attacker to crash or hang the database server through a difficult-to-exploit attack path. Affected are MySQL Server versions 8.4.0-8.4.10 and 9.7.0-9.7.1, and MySQL Cluster versions 8.0.0-8.0.47, 8.4.0-8.4.10, and 9.7.0-9.7.1. No public exploit identified at time of analysis, and Oracle disclosed this via its July 2026 Critical Patch Update; exploitation would result in complete availability loss for the targeted database instance.

Technical ContextAI

The vulnerability resides in the Clone Plugin, an InnoDB-level feature introduced in MySQL 8.0 that enables cloning of a MySQL instance over the network for provisioning and backup - accessible via multiple protocols including the native MySQL protocol. CPE data confirms the affected components are oracle_corporation:mysql_server and oracle_corporation:mysql_cluster across the listed version ranges. No CWE is assigned by Oracle, consistent with their typical advisory practice of withholding root-cause class information, but the hang-or-crash symptom pattern is consistent with resource exhaustion, unhandled exception, or assertion failure within the clone subsystem under adversarial input conditions. The 'multiple protocols' language in the description indicates the attack surface is not restricted to a single connection path.

RemediationAI

Apply Oracle's July 2026 Critical Patch Update, which addresses this vulnerability; the advisory at https://www.oracle.com/security-alerts/cpujul2026.html provides exact patched version details for each affected line. Patch available per vendor advisory - the specific fixed versions (e.g., 8.4.11, 9.7.2, or equivalent) should be confirmed directly from the CPU advisory before upgrading. As a compensating control where immediate patching is not feasible, restrict network access to MySQL ports (default 3306/33060) to trusted hosts only, reducing the network-reachable attack surface. Additionally, audit and minimize accounts holding high-privilege roles, as PR:H is a hard prerequisite - removing unnecessary SUPER or CLONE_ADMIN grants materially limits exploitation opportunity. Disabling the Clone Plugin via plugin-load-add configuration if cloning functionality is not operationally required eliminates the attack surface entirely; note this removes the ability to use MySQL Clone for provisioning and backup.