What is the CVSS score of CVE-2026-60182?

CVE-2026-60182 has a CVSS 3.1 base score of 4.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.3%.

Is there a patch available for CVE-2026-60182?

Yes, a patch is available for CVE-2026-60182. Update the affected software to the latest version immediately.

MySQL Server CVE-2026-60182

EUVD-2026-46588 MEDIUM

Uncontrolled Resource Consumption (CWE-400)

2026-07-21 oracle

GHSA-3m89-h57j-cqmr

Denial Of Service Oracle Mysql Server Mysql Cluster Red Hat Suse

4.4

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

4.4 MEDIUM

AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

4.4 MEDIUM

Network vector confirmed; PR:H because high database privileges are explicitly required; AC:H per description; availability-only impact reflects DoS-only outcome with no confidentiality or integrity compromise.

3.1 AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:H/AT:P/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

SUSE

MEDIUM

qualitative

Red Hat

4.4 MEDIUM

qualitative

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

High

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 02:18 vuln.today

CVE Published

Jul 21, 2026 - 21:33 nvd

MEDIUM 4.4

DescriptionCVE.org

Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Clone Plugin). Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and 9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H).

AnalysisAI

Denial-of-service exploitation in Oracle MySQL Server and MySQL Cluster via the Clone Plugin allows a high-privileged, network-connected attacker to cause a complete hang or repeatedly repeatable crash of the database server. Affected version ranges span MySQL Server 8.4.0-8.4.10 and 9.7.0-9.7.1, and MySQL Cluster 8.0.0-8.0.47, 8.4.0-8.4.10, and 9.7.0-9.7.1, disclosed in Oracle's July 2026 Critical Patch Update. No public exploit or active exploitation has been identified; attack complexity is high and requires pre-existing high database privileges, significantly constraining real-world risk to insider or post-breach scenarios.

Technical ContextAI

The vulnerable component is the Clone Plugin within Oracle MySQL Server and MySQL Cluster. The Clone Plugin, introduced in MySQL 8.0, provides functionality to clone data from a local or remote MySQL instance - primarily used for provisioning replicas and new cluster nodes. It operates over MySQL's standard network protocols (TCP/IP, named pipes, shared memory) and is accessible to highly privileged database accounts. The affected CPE strings (cpe:2.3:a:oracle_corporation:mysql_server:*:*:*:*:*:*:*:* and cpe:2.3:a:oracle_corporation:mysql_cluster:*:*:*:*:*:*:*:*) confirm all Oracle-distributed MySQL Server and Cluster packages in the listed version ranges are impacted. No CWE is assigned by the reporter, so the precise root-cause class is unspecified; however, the hang-or-crash outcome under high-complexity conditions is consistent with improper resource management (CWE-400), a null pointer dereference (CWE-476), or an edge-case error in Clone Plugin session handling triggered by a malformed or unexpected network-level interaction.

RemediationAI

Apply Oracle's July 2026 Critical Patch Update, which addresses CVE-2026-60182 for both MySQL Server and MySQL Cluster. Consult the official advisory at https://www.oracle.com/security-alerts/cpujul2026.html to identify the specific patched versions for each affected release train, as exact fix version numbers are not itemized in the available intelligence data. As an interim measure while patching is scheduled, strictly audit and minimize grants of SUPER, BACKUP_ADMIN, and other high-level MySQL privileges to only accounts with operational necessity - this directly eliminates the PR:H prerequisite for exploitation. If the Clone Plugin is not operationally required (e.g., no replica provisioning workflows use it), revoking BACKUP_ADMIN from non-essential accounts or disabling clone-related functionality reduces the attack surface, though this will prevent Clone Plugin-based provisioning. Network-level controls restricting MySQL port access (default 3306/TCP) to known administrative hosts provide secondary defense-in-depth but do not substitute for patching.