What is the CVSS score of CVE-2026-60180?

CVE-2026-60180 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.4%.

Which versions of MySQL Connector/C++ are affected by CVE-2026-60180?

Oracle MySQL Connector/C++ versions 9.7.0-9.7.1 contain a remotely exploitable denial of service vulnerability that allows unauthenticated network attackers to crash or hang the connector, resulting…

How to fix or mitigate CVE-2026-60180?

Within 24 hours, identify all applications and services running Oracle MySQL Connector/C++ versions 9.7.0-9.7.1, including development and production systems, and document their network exposure. Within 7 days, implement firewall rules and network access controls restricting connectivity to these connectors to only trusted sources, and enable detailed connection logging and monitoring for anomalous patterns. Within 30 days, consult Oracle's advisory for remediation guidance including potential version updates, test remediation approaches in non-production environments, and plan a coordinated rollout across affected applications.

MySQL Connector/C++ CVE-2026-60180

EUVD-2026-46586 HIGH

Uncontrolled Resource Consumption (CWE-400)

2026-07-21 oracle

GHSA-rgjp-4w23-r46v

Denial Of Service Oracle Mysql Connectors Oracle Corporation

7.5

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

7.5 HIGH

Unauthenticated remote trigger over the network with low complexity and no interaction (AV:N/AC:L/PR:N/UI:N); impact is a complete crash/hang so A:H with no confidentiality or integrity effect.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 21, 2026 - 23:06 vuln.today

CVE Published

Jul 21, 2026 - 21:33 nvd

HIGH 7.5

DescriptionCVE.org

Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/C++). Supported versions that are affected are 9.7.0-9.7.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Connectors. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Connectors. CVSS 3.1 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).

AnalysisAI

Denial of service in Oracle MySQL Connector/C++ (MySQL Connectors component) versions 9.7.0 through 9.7.1 allows an unauthenticated network attacker to trigger a hang or repeatable crash, causing a complete availability outage of the connector. The flaw is remotely and easily exploitable over multiple protocols with no user interaction, but has no confidentiality or integrity impact. No public exploit identified at time of analysis and it is not listed in CISA KEV.

Technical ContextAI

The affected component is Connector/C++, Oracle's C++ client library used by applications to connect to and communicate with MySQL database servers. As a client-side driver, it parses server responses and protocol messages; the availability-only impact (A:H with C:N/I:N) is consistent with a malformed-input or protocol-handling defect that drives the connector into an infinite hang or crash loop rather than memory corruption leading to code execution. No CWE was assigned in the source data, but the described complete DoS via crafted network interaction points to an unhandled-condition or improper-input-handling class of bug in the connector's parsing/protocol layer. The CPE cpe:2.3:a:oracle_corporation:mysql_connectors identifies the affected product family.

RemediationAI

Apply the fixes delivered in the Oracle Critical Patch Update of July 2026 (https://www.oracle.com/security-alerts/cpujul2026.html); Patch available per vendor advisory, though the input data does not specify an exact fixed version number, so consult the CPU matrix for the precise Connector/C++ release that supersedes 9.7.0/9.7.1. Until patched, reduce exposure by ensuring Connector/C++ clients only connect to trusted, authenticated MySQL servers and enforce TLS to prevent man-in-the-middle injection of malformed protocol traffic (trade-off: TLS enforcement may require certificate configuration and can break clients relying on unencrypted connections); additionally restrict network paths between application hosts and database endpoints via segmentation and firewalling so untrusted parties cannot deliver crafted traffic to the connector (trade-off: does not protect against a compromised legitimate server). Because the impact is a crash/hang, ensure application-level supervision (auto-restart, connection timeouts, retry limits) to limit outage duration.