What is the CVSS score of CVE-2026-60190?

CVE-2026-60190 has a CVSS 3.1 base score of 2.2 (Low). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:L. EPSS exploitation probability: 0.3%.

MySQL Server CVE-2026-60190

EUVD-2026-46596 LOW

Improper Access Control (CWE-284)

2026-07-21 oracle

GHSA-q5cr-vm72-r4h9

Denial Of Service Oracle Mysql Server Mysql Cluster Authentication Bypass

2.2

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

2.2 LOW

AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:L

vuln.today AI

2.2 LOW

Network-reachable via multiple protocols but requires high complexity and high-privilege credentials; only partial availability impact with no confidentiality or integrity effect.

3.1 AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:L

4.0 AV:N/AC:H/AT:N/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

High

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 02:15 vuln.today

CVE Published

Jul 21, 2026 - 21:33 nvd

LOW 2.2

DescriptionCVE.org

Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication). Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and 9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 2.2 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:L).

AnalysisAI

Partial denial-of-service in Oracle MySQL Server and MySQL Cluster's Replication component affects multiple supported release lines, exploitable only by highly privileged, authenticated attackers over the network under difficult conditions. The attack yields only a partial availability impact with no confidentiality or integrity exposure, and no public exploit code has been identified at time of analysis. Given the CVSS score of 2.2 and the combination of high complexity and high privilege requirements, this represents a low-priority, low-impact finding in the context of Oracle's July 2026 Critical Patch Update.

Technical ContextAI

The vulnerability resides in the Replication subsystem of Oracle MySQL Server and MySQL Cluster - a core component responsible for log-based data synchronization across nodes and replicas. CPE strings identify the affected products as oracle_corporation:mysql_server and oracle_corporation:mysql_cluster across multiple version branches (8.0.x, 8.4.x, 9.7.x). The flaw is reachable via multiple protocols, consistent with MySQL's support for TCP, SSL/TLS, and socket-based connectivity. No CWE has been assigned, preventing definitive root-cause classification; however, the partial-DoS-only impact pattern in a replication context is consistent with resource exhaustion, assertion failure, or improper state handling triggered by a malformed or unexpected replication message. The S:U (unchanged scope) confirms the impact is contained within the MySQL server process itself.

RemediationAI

Apply the patches distributed as part of Oracle's Critical Patch Update for July 2026, available via the advisory at https://www.oracle.com/security-alerts/cpujul2026.html. Exact fixed version numbers are not independently specified in the available data; consult the advisory directly to identify the target upgrade versions for your release branch (8.0.x, 8.4.x, or 9.7.x). As a compensating control prior to patching, restricting network access to the MySQL port (default TCP 3306 and 33060) to trusted replication peers and management hosts reduces exposure, though the PR:H requirement already limits the attacker pool to authenticated high-privilege users. Disabling replication on instances that do not require it eliminates the attack surface in the specific component entirely. Given the severity is Low (CVSS 2.2), this patch can typically be deferred to the next scheduled maintenance window rather than treated as emergency remediation.