What is the CVSS score of CVE-2026-60184?

CVE-2026-60184 has a CVSS 3.1 base score of 4.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.3%.

Is there a patch available for CVE-2026-60184?

Yes, a patch is available for CVE-2026-60184. Update the affected software to the latest version immediately.

MySQL Server CVE-2026-60184

EUVD-2026-46590 MEDIUM

Uncontrolled Resource Consumption (CWE-400)

2026-07-21 oracle

GHSA-pwwg-58j6-8xxj

Denial Of Service Oracle Mysql Server Mysql Cluster Red Hat Suse

4.4

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

4.4 MEDIUM

AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

4.4 MEDIUM

Network vector confirmed by multi-protocol replication access; PR:H and AC:H reflect required DBA credentials and specific replication conditions; no confidentiality or integrity impact applies.

3.1 AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:H/AT:P/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

SUSE

MEDIUM

qualitative

Red Hat

4.4 MEDIUM

qualitative

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

High

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 02:18 vuln.today

CVE Published

Jul 21, 2026 - 21:33 nvd

MEDIUM 4.4

DescriptionCVE.org

Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication). Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and 9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H).

AnalysisAI

Denial-of-service in MySQL Server and MySQL Cluster's Replication component allows a high-privileged, network-based attacker to cause a repeatable server hang or crash under difficult-to-reproduce conditions. Affected deployments span MySQL Server 8.4.0-8.4.10 and 9.7.0-9.7.1, plus MySQL Cluster 8.0.0-8.0.47 and the same 8.4/9.7 ranges, with Oracle issuing a fix via the July 2026 Critical Patch Update. No public exploit has been identified and this CVE is not listed in CISA KEV, but the broad version coverage across active MySQL release trains warrants timely patching for environments running MySQL replication.

Technical ContextAI

The vulnerability is located in the Replication component of Oracle MySQL Server and MySQL Cluster - the subsystem responsible for transmitting binary log events between primary and replica nodes, and supporting group replication topologies across multiple protocols. Affected products are identified by CPE strings cpe:2.3:a:oracle_corporation:mysql_server and cpe:2.3:a:oracle_corporation:mysql_cluster, spanning the 8.0, 8.4, and 9.7 release trains. No CWE identifier was assigned in the available data, so the root-cause class cannot be confirmed; however, the reported impact (hang or frequently repeatable crash) is consistent with an unhandled edge case, resource mismanagement, or improper input validation within replication protocol processing. The AC:H rating indicates that specific replication state conditions, session configurations, or protocol sequences must align before the crash becomes triggerable, suggesting the defect is not trivially reachable in all replication deployments.

RemediationAI

The primary remediation is to apply the patches issued by Oracle as part of the July 2026 Critical Patch Update, available at https://www.oracle.com/security-alerts/cpujul2026.html. The specific fixed build versions for MySQL Server and MySQL Cluster are not enumerated in the available intelligence data and must be confirmed directly from the Oracle advisory - do not infer version numbers from the affected ranges. If immediate patching is not feasible, reduce exposure by restricting network access to the MySQL replication port (default 3306) to known replica hosts and management systems only, limiting the set of accounts holding SUPER, REPLICATION SLAVE, or equivalent high-privilege grants to the minimum necessary, and auditing whether the replication subsystem is actively in use - standalone non-replicated instances may have reduced exposure. Temporarily suspending replication on non-critical replica nodes is a possible but operationally disruptive interim control, as it eliminates the attack surface at the cost of replication availability. Note that none of these compensating controls substitute for patching, as an attacker already holding DBA credentials could re-enable replication.