What is the CVSS score of CVE-2026-60188?

CVE-2026-60188 has a CVSS 3.1 base score of 4.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.3%.

Is there a patch available for CVE-2026-60188?

Yes, a patch is available for CVE-2026-60188. Update the affected software to the latest version immediately.

MySQL Server CVE-2026-60188

EUVD-2026-46594 MEDIUM

Improper Access Control (CWE-284)

2026-07-21 oracle

GHSA-cpr6-wv9j-3qvg

Oracle Mysql Server Mysql Cluster Authentication Bypass Red Hat Suse

4.4

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

4.4 MEDIUM

AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

4.4 MEDIUM

Network access required but high complexity and high privileges constrain exploitation; impact is availability-only with no confidentiality or integrity effect.

3.1 AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:H/AT:P/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

SUSE

MEDIUM

qualitative

Red Hat

4.4 MEDIUM

qualitative

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

High

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 02:16 vuln.today

CVE Published

Jul 21, 2026 - 21:33 nvd

MEDIUM 4.4

DescriptionCVE.org

Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication). Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and 9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H).

AnalysisAI

Denial of service in Oracle MySQL Server and MySQL Cluster's replication component allows a high-privileged network attacker to cause a complete hang or repeatedly crash the database server. Affected deployments span MySQL Server 8.4.0-8.4.10 and 9.7.0-9.7.1, as well as MySQL Cluster 8.0.0-8.0.47, 8.4.0-8.4.10, and 9.7.0-9.7.1. No public exploit code and no confirmed active exploitation have been identified; the high privilege and high complexity requirements substantially constrain real-world risk to insider threats or compromised DBA-level accounts.

Technical ContextAI

The vulnerability resides in the Server: Replication component of Oracle MySQL, which manages primary-to-replica data streaming and change propagation across nodes. In MySQL Cluster (NDB), this extends to a distributed, shared-nothing architecture where replication channels coordinate across multiple data nodes. The affected CPE strings - cpe:2.3:a:oracle_corporation:mysql_server and cpe:2.3:a:oracle_corporation:mysql_cluster - span multiple active version branches (8.0.x, 8.4.x, and 9.7.x), indicating the flaw is present across a wide range of release lines. Oracle has not assigned a CWE, preventing definitive root-cause classification, but the availability-only impact (A:H with C:N/I:N) and the DoS outcome (hang or frequent crash) are consistent with assertion failures, resource exhaustion, or improper input validation within the replication protocol handler.

RemediationAI

Patch via the Oracle Critical Patch Update for July 2026 at https://www.oracle.com/security-alerts/cpujul2026.html; exact patched version numbers for each affected branch (8.0.x, 8.4.x, 9.7.x) must be confirmed from the CPU patch matrix, as they are not explicitly stated in the available advisory reference. As a compensating control prior to patching, restrict network access to MySQL replication ports (default TCP 3306 and cluster-specific ports) to only trusted, explicitly authorized hosts using host-based firewall rules or MySQL's bind-address configuration - note this may disrupt legitimate replication topologies if not scoped carefully. Additionally, audit and revoke high-privilege MySQL grants such as REPLICATION SLAVE, SYSTEM_USER, and SUPER from any accounts that do not strictly require them, reducing the privilege surface an attacker would need to exploit this flaw.