MySQL Server CVE-2026-60189

Exploitation requires an attacker possessing high-privilege MySQL credentials (PR:H - DBA-level access or a replication-privileged account) with network access to the target instance via one of MySQL's supported protocols. High attack complexity (AC:H) means specific, non-trivial conditions must be met during the attack - the exact triggering configuration or timing requirement is not disclosed in the Oracle advisory or available data. The vulnerability is in the Replication component specifically, suggesting that deployments with no replication configured may have reduced or no exposure, though this is inferred from the component label rather than explicitly confirmed by Oracle. Limiting factors are: (1) PR:H - no unauthenticated or low-privilege exploitation path; (2) AC:H - requires meeting undisclosed specific conditions; (3) S:U - impact is contained to the MySQL instance itself, with no lateral scope change; (4) C:N/I:N - no confidentiality or integrity risk whatsoever, only availability.

The CVSS 3.1 vector AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H yields a score of 4.4 (Medium) and accurately reflects several significant mitigating factors. High privilege requirement (PR:H) means only a DBA-level or replication-privileged MySQL account can trigger the flaw, ruling out unauthenticated or low-privilege exploitation. High attack complexity (AC:H) indicates the attacker must meet specific, non-trivial conditions whose exact nature is unspecified in the advisory, further reducing the likelihood of casual exploitation. Impact is strictly limited to availability - no data exfiltration or tampering risk exists. No CISA KEV listing, no public POC, and no EPSS data are available, all consistent with a low-exploitation-likelihood flaw. The realistic threat model is a compromised privileged database account or a malicious insider causing a targeted database outage, not an opportunistic external attacker. This is a genuine low-priority issue for most organizations unless high-availability SLAs make even brief replication disruption unacceptable.

An attacker who has obtained high-privileged MySQL credentials - through credential theft, insider access, or compromise of a replication account - establishes network access to the target MySQL Server or Cluster. The attacker crafts and sends specific replication protocol messages that satisfy the high-complexity triggering conditions in the vulnerable component. Successful exploitation causes the MySQL Server or Cluster to hang indefinitely or enter a crash loop, taking down the database and all dependent applications until the service is manually restarted.