MySQL Server CVE-2026-60177

Exploitation requires a network-accessible MySQL Server or Cluster instance with the Clone Plugin active, and the attacker must authenticate with a high-privileged account (PR:H) - such as one holding SUPER, SYSTEM_VARIABLES_ADMIN, or CLONE_ADMIN privileges. The attack complexity is rated High (AC:H), indicating exploitation is not straightforward and likely requires specific server state, timing, or multiple attempts to trigger reliably. Exploitation is limited by: (1) requirement for pre-existing high-privilege database credentials, (2) high attack complexity precluding trivial automation, (3) impact confined to availability - no data exfiltration or integrity modification is possible through this vector. The Clone Plugin must be loaded (it is enabled by default in MySQL 8.0+ but can be removed via configuration).

The CVSS 3.1 score of 4.4 reflects several compounding limiting factors: AV:N (network reachable) is partially offset by AC:H (exploitation is difficult, implying race conditions or specific state prerequisites) and PR:H (a highly privileged database account is required). The sole impact is A:H - a complete availability loss with no confidentiality or integrity component. EPSS data is not provided; however, the combination of high privilege requirement and high complexity places this in a low-exploitation-likelihood category absent further intelligence. There is no CISA KEV listing, no POC, and no indication of active exploitation. For most organizations, the realistic risk is low due to the PR:H requirement - a threat actor who already holds high-privilege MySQL credentials has many other destructive options. Risk is elevated for multi-tenant database environments or MySQL Cluster deployments where database availability is critical and credential compromise is a plausible scenario.

An attacker who has obtained high-privilege MySQL credentials (e.g., via credential theft, insider threat, or prior compromise) connects to the target MySQL Server or Cluster instance over the network and submits a specially crafted or timed request to the Clone Plugin, triggering a hang or repeatable crash that takes the database offline. No public exploit identified at time of analysis, and AC:H indicates successful exploitation likely requires precise timing or specific server state. In a MySQL Cluster deployment, repeated triggering could cause cascading node failures and extended service outage.