MySQL Server CVE-2026-60181

Exploitation requires the attacker to have an authenticated local logon (shell or equivalent) to the infrastructure host running MySQL Server or MySQL Cluster - remote network exploitation is not possible per AV:L. The attacker must hold at minimum low-privilege OS credentials (PR:L); unauthenticated or purely remote exploitation is not applicable. High attack complexity (AC:H) means the attack is not trivially repeatable and likely depends on specific timing, file system state, or environment conditions within the Server: Configurator component. Critically, a separate human user - other than the attacker - must perform an interactive action (UI:R) during the attack window, such as running a configuration task, for the exploit to succeed. Limiting factors: (1) local access requirement eliminates external threat actors without prior footholds; (2) the UI:R dependency requires coordination or timing with another user's activity; (3) AC:H means casual or opportunistic exploitation is unlikely. Only MySQL Server and MySQL Cluster versions 9.7.0-9.7.1 are in scope.

Real-world risk is moderate despite the high-impact CVSS outcome. The local attack vector (AV:L) immediately limits the exploitable population to users who already have shell access to the MySQL host - eliminating remote threat actors without prior compromise. Attack complexity is rated High (AC:H), meaning exploitation is not straightforward and may require timing, specific environment state, or repeated attempts. Low privileges (PR:L) are sufficient but required interaction from a second user (UI:R) adds a social engineering or timing dependency that further reduces reliability. The net CVSS 3.1 score of 6.7 reflects these constraints accurately. No EPSS data was provided, preventing probability-of-exploitation quantification. KEV status is negative and no POC is public, so this is currently a theoretical risk vector. Priority should be elevated only for environments where untrusted low-privileged local users share infrastructure with MySQL 9.7.x instances. Tags include 'Information Disclosure' but the CVSS impact metrics indicate full C:H/I:H/A:H - this discrepancy may reflect Oracle's tagging convention rather than a true information-disclosure-only outcome; the authoritative CVSS metrics indicating full takeover should be treated as the primary risk signal.

A low-privileged local user on the MySQL host waits for or socially engineers a database administrator to invoke a configuration operation through the MySQL Configurator. During this window, the attacker exploits the high-complexity flaw - likely a race condition or unsafe file operation - to redirect or manipulate the Configurator's actions, ultimately achieving full compromise of the MySQL Server or Cluster instance. No public proof-of-concept exists, and the AC:H rating suggests reliable exploitation would require significant attacker effort and environment knowledge.