What is the CVSS score of CVE-2026-60185?

CVE-2026-60185 has a CVSS 3.1 base score of 4.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.3%.

Is there a patch available for CVE-2026-60185?

Yes, a patch is available for CVE-2026-60185. Update the affected software to the latest version immediately.

MySQL Server CVE-2026-60185

EUVD-2026-46591 MEDIUM

Uncontrolled Resource Consumption (CWE-400)

2026-07-21 oracle

GHSA-h992-7wpf-2vx7

Denial Of Service Oracle Mysql Server Mysql Cluster Red Hat Suse

4.4

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

4.4 MEDIUM

AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

4.4 MEDIUM

Network-accessible but difficult conditions (AC:H) and mandatory high-privilege credentials (PR:H); purely availability impact with no confidentiality or integrity effects per description.

3.1 AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:H/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

SUSE

MEDIUM

qualitative

Red Hat

4.4 MEDIUM

qualitative

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

High

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 02:17 vuln.today

CVE Published

Jul 21, 2026 - 21:33 nvd

MEDIUM 4.4

DescriptionCVE.org

Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication). Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and 9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H).

AnalysisAI

Denial-of-service in Oracle MySQL Server and MySQL Cluster's Replication component allows a high-privileged, network-connected attacker to cause a complete hang or frequently repeatable crash of the database server. Affected are MySQL Server 8.4.0-8.4.10 and 9.7.0-9.7.1, and MySQL Cluster 8.0.0-8.0.47, 8.4.0-8.4.10, and 9.7.0-9.7.1. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog; the combination of high attack complexity and high privilege requirements substantially limits realistic exploitation risk.

Technical ContextAI

The vulnerability resides in the Replication component of Oracle MySQL Server and MySQL Cluster - the subsystem responsible for binary log-based replication across primary and replica nodes. Oracle CPE strings confirm two distinct product lines are affected: cpe:2.3:a:oracle_corporation:mysql_server and cpe:2.3:a:oracle_corporation:mysql_cluster. The CWE is not specified by Oracle, consistent with their standard practice of withholding root-cause classifications in CPU advisories; however, the DoS-only impact (no confidentiality or integrity impact), high attack complexity, and replication-component targeting suggest a logic or state-management flaw - potentially a crafted replication event or protocol message that induces an unhandled exception or infinite loop in the replication thread. The vulnerability is exercisable over multiple protocols, as noted by Oracle, which is typical of MySQL's multi-protocol listener surface (classic MySQL protocol, X Protocol).

RemediationAI

Apply the Oracle Critical Patch Update for July 2026, available at https://www.oracle.com/security-alerts/cpujul2026.html, which addresses this vulnerability for all listed affected versions of MySQL Server and MySQL Cluster. Exact fixed version numbers are not independently confirmed from the provided data - consult the Oracle CPU advisory directly to identify the patched release for your specific version track (8.4.x, 9.7.x, or 8.0.x for Cluster). As a compensating control where immediate patching is not feasible, restrict network access to MySQL replication ports and interfaces to trusted replication peers only using host-based firewall rules or MySQL's bind-address configuration, reducing the network attack surface to known replica nodes. Additionally, audit and restrict accounts holding REPLICATION SLAVE or REPLICATION CLIENT privileges to the minimum required set of trusted hosts. Note that these controls reduce exposure but do not eliminate the vulnerability - an attacker with compromised high-privilege credentials from a permitted host can still trigger the flaw.