Oracle MySQL CVE-2026-60183

Exploitation requires: (1) local logon access to the host infrastructure where MySQL Server or MySQL Cluster is executing (AV:L - remote network exploitation is not possible), (2) a high-privileged MySQL or OS-level account (PR:H - low-privilege or unauthenticated access is insufficient), and (3) difficult-to-reproduce conditions within the Clone Plugin component (AC:H - likely a specific server state, timing, or operational sequence). Exploitation is limited by all three of these conditions simultaneously: the attacker cannot exploit this remotely, cannot exploit it without high-privilege credentials, and must overcome non-trivial technical complexity. Environments where high-privilege MySQL access is strictly controlled and host OS login is limited to dedicated service accounts have substantially reduced realistic exposure. The Clone Plugin must be active for the attack surface to exist; installations that do not use InnoDB Cluster or explicit clone operations may be able to disable the plugin as a workaround.

Despite reporting full confidentiality, integrity, and availability impact (C:H/I:H/A:H), the CVSS 3.1 base score of 6.4 (Medium) accurately reflects the restricted exploitation prerequisites encoded in the vector: local attack vector (AV:L), high attack complexity (AC:H), and high privileges required (PR:H). In practice, this means an attacker must already hold high-privilege access to the MySQL server host OS or a privileged MySQL account and must overcome difficult technical conditions - likely a race condition, specific operational state, or precise timing within the Clone Plugin's workflow. EPSS data is not provided in the available intelligence, making probabilistic exploitation likelihood quantification unavailable. The vulnerability is not listed in the CISA KEV catalog and no public exploit or proof-of-concept code has been identified, placing exploitation risk firmly in the theoretical category at this time. SSVC considerations: exploitation status is none/public-poc-absent; the attack is not automatable (AV:L, AC:H, PR:H); technical impact is total if achieved. Real-world priority should be moderate - the attack surface is very narrow (requires both local host access and high DB privileges simultaneously), making this a lower priority than network-exploitable, low-complexity MySQL flaws. However, the takeover outcome warrants patching as part of normal Oracle CPU remediation cycles.

An attacker who has already obtained high-privilege OS or database account access on a MySQL server host - for example, a rogue DBA or an attacker who has laterally moved within the server environment - triggers a specific condition within the Clone Plugin, potentially during a clone operation or through a crafted sequence of privileged MySQL commands, achieving full server takeover. No public exploit code exists at time of analysis, so this scenario requires significant attacker capability and environmental knowledge to execute. The high complexity requirement suggests the attacker must engineer a specific server state, such as a concurrent operation or a particular plugin lifecycle phase.