What is the CVSS score of CVE-2026-60179?

CVE-2026-60179 has a CVSS 3.1 base score of 7.4 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.3%.

Which versions of MySQL Connector/C++ are affected by CVE-2026-60179?

Oracle MySQL Connector/C++ versions 9.7.0-9.7.1 contain a critical vulnerability allowing unauthenticated remote attackers to access and modify database contents.

How to fix or mitigate CVE-2026-60179?

Within 24 hours, complete an inventory of all systems and applications using Oracle MySQL Connector/C++ versions 9.7.0 through 9.7.1, and assess the sensitivity classification of associated databases. Within 7 days, establish continuous monitoring of Oracle security advisories for release of the July 2026 Critical Patch Update, and develop a patching plan prioritizing highest-risk database environments. Within 30 days, deploy the patch to all identified systems and confirm successful upgrade to version 9.7.2 or later across your infrastructure.

MySQL Connector/C++ CVE-2026-60179

EUVD-2026-46585 HIGH

Improper Access Control (CWE-284)

2026-07-21 oracle

GHSA-466g-mmv7-4r9m

Authentication Bypass Oracle Mysql Connectors Oracle Corporation

7.4

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

7.4 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

vuln.today AI

7.4 HIGH

Network-reachable client library exploitable without auth (PR:N) but only under attacker-controlled/MITM server conditions (AC:H); data read and tamper give C:H/I:H, no crash so A:N.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 21, 2026 - 23:07 vuln.today

CVE Published

Jul 21, 2026 - 21:33 nvd

HIGH 7.4

DescriptionCVE.org

Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/C++). Supported versions that are affected are 9.7.0-9.7.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Connectors. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all MySQL Connectors accessible data as well as unauthorized access to critical data or complete access to all MySQL Connectors accessible data. CVSS 3.1 Base Score 7.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N).

AnalysisAI

Unauthorized data access and modification in Oracle MySQL Connectors (Connector/C++) versions 9.7.0 through 9.7.1 lets an unauthenticated remote attacker reach and tamper with all data accessible to the connector. The flaw is rated CVSS 7.4 with high confidentiality and integrity impact but no availability impact, and is described by Oracle as difficult to exploit (high attack complexity). No public exploit has been identified at time of analysis and it is not listed in CISA KEV; the fix ships in Oracle's July 2026 Critical Patch Update.

Technical ContextAI

MySQL Connector/C++ is Oracle's official C++ client library that lets C++ applications connect to MySQL servers over the classic MySQL protocol and the X Protocol ('multiple protocols' in the advisory). Because it is a client-side driver embedded into applications, the exploitation surface is typically the connector's handling of data exchanged with a MySQL endpoint during connection and query operations. Oracle did not assign a CWE (CWE: N/A) and, despite the 'Authentication Bypass' tag applied to the record, the CVSS vector attributes impact to confidentiality and integrity of connector-accessible data rather than a discrete auth-bypass primitive, so the precise root-cause class cannot be confirmed from the available data. The single affected CPE is cpe:2.3:a:oracle_corporation:mysql_connectors:*, which does not itself pin the 9.7.0-9.7.1 range called out in the Oracle text.

RemediationAI

Apply the fix delivered in the Oracle Critical Patch Update of July 2026 (https://www.oracle.com/security-alerts/cpujul2026.html) - patch available per vendor advisory; an exact fixed Connector/C++ build number is not stated in the provided data, so consult the CPU matrix for the release that supersedes 9.7.1 and rebuild/redeploy applications against it. As a compensating control until patched, ensure client applications connect only to trusted MySQL servers and enforce TLS with server certificate validation on the connector to reduce exposure to rogue or man-in-the-middle endpoints that could exploit the high-complexity condition; the trade-off is added certificate-management overhead and potential connection failures for servers with misconfigured certs. Restricting outbound database connectivity to known server hosts via network segmentation further limits the attack surface at the cost of reduced deployment flexibility.