What is the CVSS score of CVE-2026-60186?

CVE-2026-60186 has a CVSS 3.1 base score of 4.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.3%.

Is there a patch available for CVE-2026-60186?

Yes, a patch is available for CVE-2026-60186. Update the affected software to the latest version immediately.

MySQL Server CVE-2026-60186

EUVD-2026-46592 MEDIUM

Uncontrolled Resource Consumption (CWE-400)

2026-07-21 oracle

GHSA-6w6f-84v7-62w3

Denial Of Service Oracle Mysql Server Mysql Cluster Red Hat Suse

4.4

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

4.4 MEDIUM

AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

4.4 MEDIUM

Network vector is appropriate as Group Replication communicates over TCP; PR:H and AC:H reflect required admin credentials and unspecified complex conditions; only availability is impacted.

3.1 AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:H/AT:P/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

SUSE

MEDIUM

qualitative

Red Hat

4.4 MEDIUM

qualitative

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

High

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 02:17 vuln.today

CVE Published

Jul 21, 2026 - 21:33 nvd

MEDIUM 4.4

DescriptionCVE.org

Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Group Replication Plugin). Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and 9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H).

AnalysisAI

Denial-of-service in Oracle MySQL Server and MySQL Cluster's Group Replication Plugin allows a high-privileged, network-authenticated attacker to cause a complete hang or frequently repeatable crash of the database server. Affected deployments span MySQL Server 8.4.0-8.4.10 and 9.7.0-9.7.1, as well as MySQL Cluster 8.0.0-8.0.47, 8.4.0-8.4.10, and 9.7.0-9.7.1, as confirmed by Oracle's July 2026 Critical Patch Update. No public exploit code and no CISA KEV listing exist at time of analysis; the high attack complexity and high privilege requirement substantially limit real-world exploitation reach.

Technical ContextAI

The vulnerability resides in the Group Replication Plugin - a MySQL component that enables multi-primary and single-primary replication topologies by coordinating distributed consensus among cluster nodes via network communication. The plugin communicates over multiple protocols (TCP-based MySQL protocol and Group Communication System channels), which is reflected in the 'multiple protocols' phrasing in the advisory. CPE identifiers cpe:2.3:a:oracle_corporation:mysql_server and cpe:2.3:a:oracle_corporation:mysql_cluster confirm Oracle's upstream MySQL products are affected. No CWE was assigned by Oracle, which is consistent with Oracle's historical practice of withholding root-cause classifications in CPU advisories; based on the DoS impact pattern (hang or repeatable crash), the root cause is likely an unhandled condition or resource exhaustion within replication coordination logic. The CVSS vector's AV:N component reflects that the plugin is accessible over the network rather than only locally.

RemediationAI

Apply the patches released as part of Oracle's July 2026 Critical Patch Update by upgrading MySQL Server and MySQL Cluster to versions beyond the affected ranges (8.4.10 and 9.7.1 respectively); the Oracle advisory at https://www.oracle.com/security-alerts/cpujul2026.html provides the definitive list of patched versions, which were not individually enumerated in the available data beyond the affected-version boundaries. If immediate patching is not feasible, restrict network access to MySQL Group Replication communication ports (default: TCP 33061 for the Group Communication System) to trusted cluster nodes only using host-based firewalls or network ACLs, reducing the network attack surface while preserving cluster functionality within the trusted segment. Additionally, audit and minimize the number of accounts holding high MySQL privileges, as PR:H exploitation requires compromised administrative credentials; enforcing least-privilege access reduces the available attacker foothold. Note that disabling the Group Replication Plugin entirely is a viable workaround only if replication topology is not operationally required, as doing so terminates all Group Replication-dependent high-availability features.