MySQL Server CVE-2026-60184

Exploitation requires both a valid high-privileged database account (PR:H) - equivalent to administrator, SUPER, or REPLICATION_SLAVE privilege - and the ability to reach the MySQL instance over the network via one or more of the supported replication protocols (AV:N). Attack complexity is high (AC:H), indicating that beyond credentials and network access, specific conditions within the Replication component must be satisfied; this likely involves an active replication topology, a particular server state, or a crafted protocol sequence not reachable in default standalone deployments. Environments where MySQL replication is not configured or is disabled have materially reduced exposure, though this is not confirmed as an absolute exclusion by the Oracle advisory. Exploitation does not result in data disclosure or modification - impact is strictly limited to a server hang or crash (A:H, C:N, I:N). Non-replicated MySQL deployments and those without externally accessible high-privilege accounts represent the lowest-risk exposure tier.

The CVSS 3.1 base score of 4.4 (Medium) appropriately reflects the constrained real-world risk profile. The three most significant limiters are: PR:H (requires database administrator-level credentials), AC:H (non-trivial exploitation conditions must be met), and impact confined solely to availability (C:N, I:N, A:H). An attacker exploiting this vulnerability would already need administrative database access - a privilege level from which many other destructive actions are already possible. Scope is unchanged (S:U), meaning the compromise is contained to the MySQL instance itself. No public proof-of-concept code has been identified and no EPSS data was provided in the available intelligence, so exploitation probability cannot be quantified beyond the CVSS signals. The CVE is not listed in CISA KEV, confirming no verified active exploitation at the time of analysis. Despite the AV:N vector - which indicates network-accessible exploitation pathways across multiple protocols - the combined PR:H and AC:H factors substantially lower practical urgency. This is a genuine medium-severity issue: real and worth patching, but not an emergency for organizations without attacker-controlled DBA accounts.

An attacker who has obtained or compromised a MySQL administrator account connects to an affected MySQL Server or MySQL Cluster instance over the network and crafts a specific sequence of replication-related operations designed to trigger the defect in the Replication component. Under the right exploitation conditions (AC:H), this causes the MySQL process to hang or crash in a repeatable manner, denying service to all connected applications. No public proof-of-concept has been identified, and the AC:H rating suggests that replicating the crash reliably requires knowledge of specific server state or topology configurations.