MySQL Connector/Net CVE-2026-60193

Exploitation requires the low-privileged attacker to have network reach to the vulnerable connector over one of the multiple supported MySQL protocols (PR:L confirms some pre-existing privilege is needed; per CVSS this is authenticated). The high attack complexity (AC:H) means success is conditional on hard-to-control factors - Oracle labels it 'difficult to exploit' - likely requiring the attacker to control or interpose on the database endpoint the connector communicates with so it can return crafted protocol data to the client. Limiting factors: only Connector/Net versions 9.7.0 and 9.7.1 are affected; the target must be a .NET application actually using this connector; and the attacker must both hold low-level privileges and win the high-complexity condition, which together make opportunistic mass exploitation unlikely.

Signals here are mixed and warrant nuance. The CVSS 3.1 score of 8.5 is HIGH and driven largely by the scope change (S:C) plus full C:H/I:H/A:H impact, but two metrics substantially temper real-world risk: AC:H (Oracle explicitly calls it 'difficult to exploit') and PR:L (the attacker must already hold some low-level privilege). No EPSS score was provided, so exploitation probability cannot be quantified. It is NOT in CISA KEV (no confirmed active exploitation) and no POC was supplied, so this is best treated as a real but non-emergency priority - patch on a normal CPU cadence rather than as an out-of-band fire drill. One tension to verify with Oracle: AV:N implies a network vector, yet a client-side connector is typically attacked by a malicious or compromised server/peer it talks to, so 'network access' realistically means the attacker controls or interposes on the database endpoint the connector reaches - confirm the exact attack surface before finalizing exposure assumptions.

An attacker who controls or can intercept a MySQL endpoint that a vulnerable .NET application connects to - via a compromised database host, a rogue server, or a man-in-the-middle position - returns crafted protocol responses that trigger the connector flaw, taking over the connector's execution context within the client application. Because of the scope change, this foothold can be leveraged to impact resources beyond the connector, such as the host application and its data. No public POC is available, and the high attack complexity means the attacker must satisfy specific timing or configuration preconditions to succeed.