MySQL Server CVE-2026-60188

Exploitation requires a high-privileged database account (PR:H per the CVSS vector), meaning the attacker must control credentials equivalent to DBA, SYSTEM_USER, SUPER, or a high-privilege replication account on the target MySQL instance. High attack complexity (AC:H) further requires specific conditions within the replication subsystem - such as particular server state, timing, or protocol sequencing - that are not trivially reproducible, meaning exploitation is not straightforward even with the required credentials. No user interaction is required once the attacker has obtained the necessary access. Exploitation is limited to the specific version ranges listed: MySQL Server 8.4.0-8.4.10 and 9.7.0-9.7.1, and MySQL Cluster 8.0.0-8.0.47, 8.4.0-8.4.10, and 9.7.0-9.7.1. Unauthenticated attackers and low-privileged users cannot trigger this flaw.

The CVSS 3.1 base score of 4.4 (Medium) accurately reflects a constrained attack profile: while the attack vector is network-based (AV:N), exploitation requires both high attack complexity (AC:H) and high privileges (PR:H), meaning an attacker must already control a DBA-level or equivalent MySQL account. The availability impact is maximal (A:H), but confidentiality and integrity are entirely unaffected (C:N/I:N). No EPSS data is available in the provided intelligence, and the CVE does not appear in the CISA KEV catalog, confirming no known active exploitation. No proof-of-concept code has been identified. The combination of AC:H and PR:H makes opportunistic or mass exploitation highly improbable; realistic threat actors would be insiders or attackers who have already achieved significant database-level compromise. This vulnerability should be addressed during normal quarterly patch cycles rather than treated as an emergency. The scope is unchanged (S:U), meaning a compromised MySQL process cannot pivot to the underlying host via this flaw alone.

An attacker who has obtained or compromised a high-privileged MySQL account - such as a DBA credential leaked via phishing or a replication service account - connects to a MySQL Server or Cluster instance over the network and sends specially crafted input targeting the replication subsystem under conditions that satisfy the high attack complexity requirement. The server subsequently enters a hang state or crashes repeatedly, rendering the database unavailable to all connected applications and clients. No public proof-of-concept exploit has been identified at the time of analysis.