MySQL Connector/NET CVE-2026-60192

Exploitation targets the client side: an attacker must be able to make a vulnerable application using Connector/NET 9.7.0-9.7.1 connect to an attacker-controlled or attacker-interposed MySQL endpoint, then deliver malicious server responses over one of the supported MySQL protocols ('multiple protocols'). No authentication is required (PR:N) and no user interaction is required (UI:N), but the CVSS AC:H flag indicates a meaningful limiting condition - realistically a malicious/compromised server or a man-in-the-middle position on the connection, plus the app running the specific affected 9.7.x connector build. It is NOT remotely exploitable against a default, correctly-configured connector talking only to a trusted server over validated TLS.

The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) shows a network-reachable, unauthenticated issue with HIGH attack complexity and full C/I/A impact, yielding an 8.1 High score. The AC:H metric is the key mitigating signal: successful exploitation likely requires a special condition such as a malicious or compromised MySQL server, or a man-in-the-middle position on the connection, rather than trivial packet spraying - this is typical of client-library 'takeover' bugs. No EPSS score, SSVC decision, POC, or KEV listing is present in the provided data, so there is no evidence of active or automatable exploitation; the score is driven by potential impact, not demonstrated ease. Net assessment: a genuinely serious flaw where it applies, but real-world priority is moderated by high complexity and the need for a hostile server/network path. EPSS and SSVC data are missing and should be checked before final prioritization.

An attacker who controls or impersonates a MySQL server (for example via DNS/connection-string tampering or a MITM position on the network path) waits for a vulnerable .NET application using Connector/NET 9.7.x to connect. The malicious server returns crafted protocol responses that exploit the connector, resulting in takeover of the connector context on the application host. High attack complexity means the attacker must first achieve the malicious-server or interception precondition; no public POC is available at time of analysis.