What is the CVSS score of CVE-2026-60178?

CVE-2026-60178 has a CVSS 3.1 base score of 6.6 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Is there a patch available for CVE-2026-60178?

Yes, a patch is available for CVE-2026-60178. Update the affected software to the latest version immediately.

MySQL Server CVE-2026-60178

EUVD-2026-46584 MEDIUM

Improper Access Control (CWE-284)

2026-07-21 oracle

GHSA-j25j-8q48-6xw7

Oracle Mysql Server Mysql Cluster Authentication Bypass Red Hat Suse

6.6

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

6.6 MEDIUM

AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

6.6 MEDIUM

Network vector confirmed; AC:H and PR:H reflect difficult exploitation requiring high-privilege credentials and specific Clone Plugin conditions; full CIA impact consistent with 'takeover' description.

3.1 AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

MEDIUM

qualitative

Red Hat

6.6 MEDIUM

qualitative

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

High

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 02:19 vuln.today

CVE Published

Jul 21, 2026 - 21:33 nvd

MEDIUM 6.6

DescriptionCVE.org

Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Clone Plugin). Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and 9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster. Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 6.6 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Full takeover of MySQL Server and MySQL Cluster is possible through a difficult-to-exploit vulnerability in the Clone Plugin component, requiring a high-privileged attacker with network access via multiple protocols. Affected are MySQL Server versions 8.4.0-8.4.10 and 9.7.0-9.7.1, and MySQL Cluster versions 8.0.0-8.0.47, 8.4.0-8.4.10, and 9.7.0-9.7.1. No public exploit code or CISA KEV listing has been identified at time of analysis; risk is tempered by the AC:H/PR:H exploitation prerequisites, though the full CIA:H/H/H impact warrants priority patching in environments using the Clone Plugin.

Technical ContextAI

The vulnerability resides in the Clone Plugin component of Oracle MySQL, a feature introduced to enable efficient cloning of MySQL data from a remote donor instance to a local recipient over the network. The affected CPEs (cpe:2.3:a:oracle_corporation:mysql_server and mysql_cluster) span both the standalone MySQL Server (8.4.x, 9.7.x) and MySQL Cluster (8.0.x, 8.4.x, 9.7.x), indicating the flaw is present across product lines that share Clone Plugin code. No CWE was assigned, limiting precise root-cause classification; however, the 'takeover' outcome with full C/I/A impact suggests a serious memory corruption, privilege escalation, or authentication bypass within the Clone Plugin's network-facing code path. The CVSS vector AV:N reflects that exploitation occurs over the network, and AC:H suggests specific and non-trivial preconditions must align - potentially related to replication topology, timing, or specific protocol state.

RemediationAI

The primary remediation is to apply the patches released as part of Oracle's Critical Patch Update for July 2026, available at https://www.oracle.com/security-alerts/cpujul2026.html - the advisory should specify the exact patched versions for MySQL Server 8.4.x, 9.7.x and MySQL Cluster 8.0.x, 8.4.x, 9.7.x; those version numbers were not independently confirmed in the available input data and should be verified directly from Oracle. As a compensating control prior to patching, organizations should audit and restrict which accounts hold the CLONE_ADMIN or BACKUP_ADMIN privilege, as these are required to use the Clone Plugin, thereby directly limiting who could trigger this flaw. Additionally, firewall rules restricting MySQL port access (default TCP 3306, and the Clone Plugin's donor port, typically TCP 3307) to only trusted internal hosts reduce exposure significantly. Disabling the Clone Plugin entirely via 'UNINSTALL PLUGIN clone;' is an option if the feature is not operationally required, though this will interrupt any replication or disaster-recovery workflows that rely on it.