MySQL Server CVE-2026-60187

Exploitation requires the attacker to hold high-privileged credentials (PR:H), meaning they must already control a DBA-level account or a dedicated replication-privileged account (e.g., REPLICATION SLAVE grant) on the target MySQL instance - this is the primary limiting factor. Attack complexity is rated High (AC:H), indicating that exploitation is not straightforward and requires meeting conditions beyond attacker control, such as a race condition, a specific replication channel state, or a particular server configuration mode; reliable exploitation is therefore non-trivial even for a credentialed attacker. The vulnerability is specifically scoped to the Replication component, meaning a standalone MySQL deployment without active replication configured is unlikely to expose the same attack surface. The attack vector is network-based (AV:N) and requires no user interaction (UI:N), so once credentials and conditions are satisfied, no victim action is needed. Exploitation offers no confidentiality or integrity impact - only availability disruption - providing no direct data exfiltration path.

The CVSS 3.1 base score of 4.4 (Medium) accurately reflects the constrained exploitation conditions: while AV:N confirms network reachability, AC:H requires the attacker to meet non-trivial preconditions, and PR:H mandates DBA-level or replication-privileged credentials. Scope is unchanged (S:U), and the only impact is complete availability loss (A:H) with no confidentiality or integrity exposure (C:N/I:N). No EPSS data is available in the provided intelligence, and this CVE does not appear in the CISA KEV catalog, indicating no observed in-the-wild exploitation at time of analysis. No public proof-of-concept has been identified. These signals collectively indicate this is a real but constrained risk - the high privilege bar effectively limits exploitation to insider threats, compromised DBA accounts, or malicious replica server operators. For most organizations, this is a moderate-priority patch to be addressed in the next scheduled maintenance window rather than an emergency response. The risk is elevated in environments operating MySQL replication topologies with shared or weakly controlled administrative credentials.

A high-privileged database user - such as a replication account, DBA, or an attacker who has compromised such credentials - with network access sends specially crafted traffic to the target MySQL Server or Cluster's replication interface. Due to the AC:H rating, the attacker must satisfy specific non-standard conditions, such as a particular server state or replication topology configuration, before the flaw can be reliably triggered. If successful, the MySQL instance hangs or crashes in a frequently repeatable manner, causing a complete denial of service to all applications dependent on that database instance.