MySQL Server CVE-2026-60185

Exploitation requires a high-privileged attacker account with network access to the MySQL instance - the CVSS vector PR:H confirms high privileges are mandatory, ruling out unauthenticated or low-privilege exploitation. The Replication component must be in use or accessible; environments that do not use MySQL replication may have reduced or no exposure to this attack surface. Attack complexity is High (AC:H), meaning specific conditions beyond attacker control must be present - Oracle does not detail these conditions in the public advisory, which is standard for Oracle CPU disclosures. The vulnerability is reachable via multiple protocols (classic MySQL protocol and potentially X Protocol). Limiting factors: requires pre-existing high-privilege database access, difficult exploitation conditions (AC:H), and purely DoS impact with no lateral movement or data exfiltration potential. No special OS-level access or physical access is required.

The overall risk profile is moderate-to-low despite MySQL's ubiquitous deployment footprint. The CVSS 3.1 base score of 4.4 (Medium) accurately reflects the constraining factors: AV:N confirms network accessibility, but AC:H indicates difficult exploitation requiring specific conditions not detailed by Oracle, and PR:H means the attacker must already hold high-privileged database credentials. The impact is purely availability - no confidentiality or integrity risk. No EPSS data was provided, but given the absence of KEV listing and no public exploit code, opportunistic exploitation is unlikely. The realistic threat scenario is a privileged insider or compromised DBA credential holder deliberately or accidentally triggering the crash. For organizations running MySQL replication at scale (e.g., high-availability clusters, read replicas), a repeatable crash of the replication component could cause significant operational disruption. CVSS and description are consistent - no conflicting signals detected. This is not a fire-drill priority; patch within normal patch cycles unless replication is critical infrastructure.

An attacker who has obtained or already possesses high-privileged MySQL credentials - for example, a DBA account or a compromised replication service account - connects to an affected MySQL Server or Cluster instance over the network and sends a specially crafted sequence of replication-related commands or protocol messages to the Replication component. The high attack complexity (AC:H) implies that specific timing, state, or configuration conditions must align for the attack to succeed. If those conditions are met, the MySQL Server process enters a hang or crashes repeatedly, denying database service to all dependent applications. No public exploit code has been identified at time of analysis.