What is the CVSS score of CVE-2026-60192?

CVE-2026-60192 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of MySQL Connector/NET are affected by CVE-2026-60192?

MySQL Connector/NET versions 9.7.0 and 9.7.1 are vulnerable to remote, unauthenticated attacks that could allow attackers to completely compromise any .NET application using this database connector,…

How to fix or mitigate CVE-2026-60192?

Within 24 hours: Inventory all .NET applications in production and non-production environments to identify those using MySQL Connector/NET versions 9.7.0 or 9.7.1, and categorize by data sensitivity and network exposure. Within 7 days: Develop and test an upgrade plan to migrate affected applications to MySQL Connector/NET 9.6.x (the stable prior release) or evaluate alternative data access solutions while monitoring for patch availability; coordinate with application teams and conduct regression testing in staging environments. Within 30 days: Complete deployment of upgraded or mitigated applications to production, ensuring no instances remain on versions 9.7.0 or 9.7.1, and establish a monitoring protocol to detect when Oracle releases a patch to plan any forward-migration activities.

MySQL Connector/NET CVE-2026-60192

EUVD-2026-46598 HIGH

Improper Access Control (CWE-284)

2026-07-21 oracle

GHSA-4qp5-2fxg-r4vj

Authentication Bypass Oracle Mysql Connectors Oracle Corporation

8.1

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.1 HIGH

Network-reachable client flaw with no auth (PR:N) but requiring a malicious/interposed server (AC:H); full connector takeover justifies C:H/I:H/A:H, scope unchanged.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 21, 2026 - 23:05 vuln.today

CVE Published

Jul 21, 2026 - 21:33 nvd

HIGH 8.1

DescriptionCVE.org

Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/Net). Supported versions that are affected are 9.7.0-9.7.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Connectors. Successful attacks of this vulnerability can result in takeover of MySQL Connectors. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Full compromise ("takeover") of Oracle's MySQL Connector/NET client library affects the ADO.NET data provider in MySQL Connectors versions 9.7.0 and 9.7.1, where an unauthenticated network attacker can seize control of the connector, impacting confidentiality, integrity, and availability of any .NET application relying on it. Rated CVSS 3.1 8.1 (High) with high attack complexity, this is a client-side flaw disclosed in Oracle's July 2026 Critical Patch Update. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Technical ContextAI

MySQL Connector/NET (Connector/Net) is Oracle's fully-managed ADO.NET driver that lets .NET/C

applications communicate with MySQL servers over the MySQL client/server protocol (and related transports such as X Protocol). Because the flaw resides in the connector - the client-side component - rather than the MySQL server, the exposure is on the application host that establishes outbound MySQL connections. The affected CPE is cpe:2.3:a:oracle_corporation:mysql_connectors, scoped to Connector/Net 9.7.0 through 9.7.1. Oracle marks CWE as N/A and does not publish a root-cause class; the 'via multiple protocols' language and full C/I/A impact are consistent with a parsing or response-handling defect in how the connector processes data returned by a (potentially malicious or interposed) server.

RemediationAI

Apply the fix from Oracle's July 2026 Critical Patch Update (https://www.oracle.com/security-alerts/cpujul2026.html) by upgrading Connector/NET past the affected 9.7.0-9.7.1 range to the patched release Oracle lists in that CPU (exact fixed version is defined in the advisory and should be taken from it - Patch available per vendor advisory). Until you can update the library in every affected .NET application, reduce exposure by ensuring connectors only reach trusted, authenticated MySQL servers and by enforcing TLS with server certificate validation to blunt man-in-the-middle exploitation of this client-side flaw (trade-off: requires valid server certificates and may break apps relying on unverified connections). Additionally, restrict outbound database connectivity from application hosts to known MySQL endpoints via network segmentation/egress filtering to prevent connectors from being pointed at attacker-controlled servers.