What is the CVSS score of CVE-2026-60183?

CVE-2026-60183 has a CVSS 3.1 base score of 6.4 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Is there a patch available for CVE-2026-60183?

Yes, a patch is available for CVE-2026-60183. Update the affected software to the latest version immediately.

Oracle MySQL CVE-2026-60183

EUVD-2026-46589 MEDIUM

Improper Privilege Management (CWE-269)

2026-07-21 oracle

GHSA-vvw5-63v6-mjmw

Oracle Mysql Server Mysql Cluster Privilege Escalation Red Hat Suse

6.4

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

6.4 MEDIUM

AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

6.4 MEDIUM

Local host access (AV:L) and high DB/OS privileges (PR:H) are required; difficult conditions (AC:H) apply; full takeover justifies C/I/A:H with unchanged scope.

3.1 AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:H/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

MEDIUM

qualitative

Red Hat

6.4 MEDIUM

qualitative

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Local

Attack Complexity

High

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 02:18 vuln.today

CVE Published

Jul 21, 2026 - 21:33 nvd

MEDIUM 6.4

DescriptionCVE.org

Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Clone Plugin). Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and 9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where MySQL Server, MySQL Cluster executes to compromise MySQL Server, MySQL Cluster. Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 6.4 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Full takeover of Oracle MySQL Server and MySQL Cluster is possible through a local, high-complexity vulnerability in the Clone Plugin component, affecting MySQL Server 8.4.0-8.4.10 and 9.7.0-9.7.1, and MySQL Cluster 8.0.0-8.0.47, 8.4.0-8.4.10, and 9.7.0-9.7.1. Exploitation requires an attacker with high privileges and local logon access to the host infrastructure where MySQL executes, under difficult-to-achieve conditions, limiting realistic risk despite the full confidentiality, integrity, and availability impact. No public exploit code and no CISA KEV listing have been identified at time of analysis, and Oracle disclosed this via the July 2026 Critical Patch Update.

Technical ContextAI

The Clone Plugin (introduced in MySQL 8.0) is a server-side component enabling data cloning operations - copying data from a donor MySQL instance to a recipient, used heavily in InnoDB Cluster and MySQL Cluster high-availability setups. Affected products per CPE data are oracle_corporation:mysql_server and oracle_corporation:mysql_cluster across the version ranges disclosed. The vulnerability resides specifically in this plugin's handling logic on the server side. No CWE was assigned by Oracle (listed as N/A), making precise root-cause classification (e.g., memory corruption, logic flaw, privilege escalation path) unconfirmed from available data; however, the CVSS vector (AV:L/AC:H/PR:H) indicates the flaw is only reachable by a locally-present, already highly-privileged actor under specific conditions, consistent with an internal privilege escalation or unsafe operation within the plugin's infrastructure-layer execution context. The tag 'Information Disclosure' in EUVD metadata is notable but potentially inconsistent with the full C:H/I:H/A:H impact claimed by Oracle, which describes complete takeover; this discrepancy is unresolved from available data.

RemediationAI

Apply patches provided by Oracle through the July 2026 Critical Patch Update (CPU), available at https://www.oracle.com/security-alerts/cpujul2026.html. Oracle CPUs deliver cumulative fixes, and the advisory should be consulted for exact patched version numbers for each affected branch (MySQL Server 8.4.x, 9.7.x; MySQL Cluster 8.0.x, 8.4.x, 9.7.x) - specific fix versions are not independently confirmed from the available data beyond the CPU reference. As a compensating control pending patching, restrict local OS-level logon access to MySQL server hosts to the minimum required administrative accounts, reducing the pool of principals who could satisfy the AV:L/PR:H prerequisites. Additionally, audit and restrict MySQL user accounts holding high privileges (SUPER, CLONE_ADMIN, SYSTEM_VARIABLES_ADMIN) to only those accounts requiring Clone Plugin functionality; disabling the Clone Plugin entirely via plugin removal or startup options (--skip-plugin-load) is a viable workaround where replication cloning features are not required, though this will disable InnoDB Cluster provisioning workflows. No workaround eliminates risk without patching if the Clone Plugin must remain active.