MySQL Server CVE-2026-60186

Exploitation requires the attacker to hold high-level MySQL privileges (PR:H - equivalent to SUPER, SYSTEM_VARIABLES_ADMIN, or GROUP_REPLICATION_ADMIN), obtainable only through legitimate administrative credentials or prior credential compromise. The Group Replication Plugin must be actively configured and running on the target instance; deployments using standalone MySQL without group replication are not in scope. High attack complexity (AC:H) indicates additional conditions beyond the attacker's control must align - likely specific cluster state, protocol timing, or node membership conditions. No user interaction is required (UI:N). Exploitation is limited to: (1) high-privileged authenticated sessions only, (2) instances where Group Replication is enabled and operational, and (3) scenarios satisfying unspecified high-complexity conditions. The absence of confidentiality or integrity impact means successful exploitation yields only a DoS outcome, not data exfiltration or code execution.

The CVSS 3.1 base score of 4.4 (Medium) reflects a combination of signals that significantly depress real-world risk: AV:N indicates network reachability, but AC:H (high attack complexity) means specific conditions must be met beyond the attacker's direct control, and PR:H requires the attacker to already possess high-level MySQL privileges (e.g., SUPER or equivalent administrative credentials). The sole impact axis is Availability (A:H), with no confidentiality or integrity exposure. No EPSS score was provided in the input data, so exploitation probability cannot be quantified numerically. The vulnerability carries no CISA KEV listing and no known public exploit code, indicating it has not been observed in active campaigns. Taken together, this is a low operational priority for most organizations: an attacker would need to already control a high-privileged database account and satisfy high-complexity preconditions to achieve a DoS that provides no data theft or code execution capability. The primary realistic concern is an insider threat or a post-compromise scenario where an attacker with stolen DBA credentials seeks to disrupt database availability.

A database administrator account (or an attacker who has compromised one) connects to a MySQL Server or Cluster node over the network and sends a specially crafted sequence of requests targeting the Group Replication Plugin's coordination logic, satisfying the high-complexity preconditions. The server or cluster node enters a hang state or crashes in a loop, denying service to all legitimate database clients. No public proof-of-concept code exists at time of analysis, meaning this scenario currently requires independent vulnerability research to execute.