MySQL Connector/C++ CVE-2026-60179

Exploitation requires network reachability between the affected connector (Connector/C++ 9.7.0-9.7.1) and the attacker, over one of the MySQL protocols the connector speaks (classic MySQL protocol or X Protocol). No authentication or user interaction is needed per the CVSS vector (PR:N/UI:N), but the AC:H rating signals that success depends on conditions the attacker cannot fully control - realistically, the client must initiate or accept a connection to an attacker-controlled or man-in-the-middle MySQL server, since this is a client-side driver rather than a listening service. Limiting factors: only versions 9.7.0 and 9.7.1 of the Connector/C++ component are affected, exploitation is rated difficult, and environments that connect only to trusted servers over validated TLS materially reduce realistic exposure.

The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N) shows a network-reachable, unauthenticated issue that is nonetheless high-complexity (AC:H), meaning an attacker needs conditions outside their control - such as a specific timing, state, or a malicious/compromised server the client connects to - to succeed. Impact is significant on the confidentiality and integrity side (C:H/I:H) with no availability impact (A:N), consistent with data disclosure/tampering rather than crash or RCE. No EPSS score, KEV listing, POC, or SSVC decision was provided in the input, so real-world exploitation probability cannot be quantified; the AC:H rating and typical Oracle CPU bundling suggest this is a patch-on-cycle priority rather than an emergency. Note a caveat: as a client library, the realistic threat model is a rogue or man-in-the-middle MySQL server attacking connecting clients, which the network vector supports but which limits mass, opportunistic exploitation.

An application built with MySQL Connector/C++ 9.7.0 or 9.7.1 connects to a MySQL endpoint that an attacker controls or has interposed on (e.g., via MITM on an untrusted network). The malicious server returns specially crafted protocol responses that trigger the connector flaw, allowing the attacker to read or alter data the connector handles. No public POC is available, and the high attack complexity means the attacker must satisfy non-trivial conditions to reliably succeed.