What is the CVSS score of CVE-2026-60191?

CVE-2026-60191 has a CVSS 3.1 base score of 4.1 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.1%.

Is there a patch available for CVE-2026-60191?

Yes, a patch is available for CVE-2026-60191. Update the affected software to the latest version immediately.

MySQL Server CVE-2026-60191

EUVD-2026-46597 MEDIUM

Improper Access Control (CWE-284)

2026-07-21 oracle

GHSA-4mj7-v3mq-c9q2

Oracle Mysql Server Mysql Cluster Authentication Bypass Red Hat Suse

4.1

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

4.1 MEDIUM

AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

4.1 MEDIUM

Local access and high-privilege account required per description; high complexity reflects difficult-to-reproduce replication conditions; impact is availability-only with no confidentiality or integrity loss.

3.1 AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H

4.0 AV:L/AC:H/AT:P/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

SUSE

MEDIUM

qualitative

Red Hat

4.1 MEDIUM

qualitative

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Local

Attack Complexity

High

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 02:15 vuln.today

CVE Published

Jul 21, 2026 - 21:33 nvd

MEDIUM 4.1

DescriptionCVE.org

Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication). Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and 9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where MySQL Server, MySQL Cluster executes to compromise MySQL Server, MySQL Cluster. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.1 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H).

AnalysisAI

Denial-of-service exposure in MySQL Server and MySQL Cluster's Replication component allows a high-privileged local attacker to repeatedly crash or hang the database service under difficult-to-reproduce conditions. Affected are MySQL Server versions 8.4.0-8.4.10 and 9.7.0-9.7.1, and MySQL Cluster 8.0.0-8.0.47, 8.4.0-8.4.10, and 9.7.0-9.7.1. Oracle addressed this in the July 2026 Critical Patch Update; no public exploit code or active exploitation has been identified at time of analysis.

Technical ContextAI

The vulnerability resides in the Replication component of Oracle MySQL Server and MySQL Cluster, both of which use replication as a core high-availability and data-distribution mechanism. Replication in MySQL involves binary log processing, replication threads (IO and SQL threads), and coordinated state management between primary and replica nodes. A flaw in this subsystem - exact CWE not disclosed by Oracle (listed N/A) - can be triggered under high-complexity conditions by a high-privileged account with local access to the infrastructure, causing the replication process or the server itself to enter a hang state or crash repeatably. The CPE identifiers confirm Oracle Corporation's mysql_server and mysql_cluster products across the affected version ranges. The absence of a CWE classification limits root-cause specificity; the behavior (hang or repeatable crash) is consistent with a resource exhaustion, null dereference, or assertion failure class of defect.

RemediationAI

Patch available per Oracle CPU July 2026 advisory. Organizations should apply the patches distributed in Oracle's July 2026 Critical Patch Update by consulting the advisory at https://www.oracle.com/security-alerts/cpujul2026.html for exact fixed version numbers, as specific patched release identifiers were not independently confirmed from the available input data. For environments where immediate patching is not feasible, compensating controls should focus on the attack prerequisites: restrict local OS-level logon access to the MySQL host to only authorized administrators, enforce least-privilege principles on MySQL accounts (avoid granting SUPER or REPLICATION SLAVE privileges unnecessarily), and monitor for anomalous replication thread behavior or unexpected mysqld restarts via system logging. Note that these mitigations reduce the attack surface but do not eliminate the underlying defect. If MySQL Cluster replication is not required in a given deployment, disabling or isolating replication components reduces exposure, though this carries operational trade-offs for high-availability configurations.