MySQL Server CVE-2026-60190

Exploitation requires: (1) high-privilege authenticated access to the MySQL instance - PR:H per the CVSS vector, meaning the attacker must possess an account with elevated MySQL privileges such as SUPER, SYSTEM_VARIABLES_ADMIN, or equivalent replication-related grants; (2) network access to the MySQL server via any supported protocol (TCP, SSL, socket); and (3) high attack complexity (AC:H), indicating that exploitation is not straightforward and likely depends on a specific server state, race condition, or precise message sequence within the Replication component. The attack does not require user interaction. Limiting factors are significant: the PR:H requirement means unauthenticated or low-privilege attackers cannot exploit this; AC:H means reliable exploitation is non-trivial; and the impact ceiling is partial availability only, with no confidentiality or integrity exposure. Exploitation against default MySQL configurations is possible in principle but constrained by the privilege requirement.

The aggregate risk signal for this CVE is very low. The CVSS 3.1 base score of 2.2 reflects three compounding mitigating factors in the vector (AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:L): network reachability is required but attack complexity is High, and the attacker must already hold high-privilege credentials on the MySQL instance. The sole impact is partial availability - a partial DoS - with no confidentiality or integrity consequence. No KEV listing exists, no public exploit code has been identified, and EPSS data is not provided. The SSVC framing would place this at 'Track' or lower: exploitation is not confirmed, the technical impact is partial and availability-only, and automation of the attack is constrained by the AC:H requirement. There are no conflicting signals in the provided data; all sources (Oracle advisory, EUVD-2026-46596, CPE) are consistent. This issue is unlikely to rise to immediate remediation priority outside of environments with strict patch compliance mandates.

An attacker who has already obtained high-privilege MySQL credentials - for example, a rogue DBA or a compromised application account with SUPER or REPLICATION_SLAVE privileges - sends a specially crafted request targeting the Replication component over the network under conditions that satisfy the high-complexity requirement (such as a specific server state or timing condition). Successful exploitation causes a partial disruption to MySQL Server or Cluster availability, such as a process stall or temporary unavailability of replication threads. No public exploit code has been identified at time of analysis.