What is the CVSS score of CVE-2026-60181?

CVE-2026-60181 has a CVSS 3.1 base score of 6.7 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

MySQL Server CVE-2026-60181

EUVD-2026-46587 MEDIUM

Improper Access Control (CWE-284)

2026-07-21 oracle

GHSA-45m2-q4fh-q3gx

Authentication Bypass Oracle Red Hat Mysql Cluster Mysql Server Oracle Corporation

6.7

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

6.7 MEDIUM

AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

6.7 MEDIUM

Local vector and low privileges confirmed by description; high complexity and required user interaction align with a configurator race or file-manipulation scenario yielding full takeover.

3.1 AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H

4.0 AV:L/AC:H/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Red Hat

6.7 MEDIUM

qualitative

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Local

Attack Complexity

High

Privileges Required

Low

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 02:19 vuln.today

CVE Published

Jul 21, 2026 - 21:33 nvd

MEDIUM 6.7

DescriptionCVE.org

Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Configurator). Supported versions that are affected are MySQL Server: 9.7.0-9.7.1; MySQL Cluster: 9.7.0-9.7.1. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where MySQL Server, MySQL Cluster executes to compromise MySQL Server, MySQL Cluster. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 6.7 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H).

AnalysisAI

Full takeover of MySQL Server and MySQL Cluster 9.7.0-9.7.1 is achievable via a local, low-privileged attacker exploiting a flaw in the Server: Configurator component, provided a second user interacts during the attack window. The CVSS 3.1 score of 6.7 reflects the high attack complexity and local-only vector, which meaningfully constrain real-world exploitability despite the high-impact outcome (C:H/I:H/A:H). No public exploit code has been identified at time of analysis, and CISA KEV confirmation is absent.

Technical ContextAI

The vulnerability resides in the Server: Configurator component of Oracle MySQL Server and MySQL Cluster, versions 9.7.0 through 9.7.1, as identified by CPE strings cpe:2.3:a:oracle_corporation:mysql_server and cpe:2.3:a:oracle_corporation:mysql_cluster. The Configurator is responsible for initial and runtime configuration management of MySQL instances. CWE classification is not provided by Oracle, making precise root-cause categorization difficult; however, the AV:L/AC:H/UI:R vector pattern is consistent with insecure file handling, privilege escalation via configuration race conditions, or symlink-based attacks during configuration operations. The local attack vector confirms the vulnerability is not network-reachable and requires physical or authenticated shell access to the host running MySQL.

RemediationAI

Apply the patch released as part of Oracle's July 2026 Critical Patch Update (CPU), available via the Oracle advisory at https://www.oracle.com/security-alerts/cpujul2026.html. Oracle has not published a specific patched version number beyond the CPU cycle; organizations should verify the exact patched build through the Oracle support portal. Exact fix version is not independently confirmed from available data - consult Oracle My Support for the specific patched release. Where immediate patching is not feasible, restrict local logon access to the MySQL host to the minimum set of trusted, privileged accounts, as the attack requires an authenticated local session (PR:L). Audit and harden OS-level file permissions on MySQL Configurator-related files and directories to prevent manipulation by non-DBA local users. Enabling mandatory access controls (SELinux, AppArmor) with a MySQL-specific profile can limit privilege escalation pathways from the Configurator component.