What is the CVSS score of CVE-2026-60193?

CVE-2026-60193 has a CVSS 3.1 base score of 8.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of MySQL Connector/Net are affected by CVE-2026-60193?

Oracle MySQL Connector/Net versions 9.7.0 and 9.7.1 contain a critical vulnerability enabling complete system takeover by low-privileged network attackers, exposing affected organizations to…

How to fix or mitigate CVE-2026-60193?

Within 24 hours, complete an inventory of systems and applications using Oracle MySQL Connector/Net 9.7.0 or 9.7.1 and implement network segmentation to restrict access to affected systems. Within 7 days, deploy the Oracle July 2026 Critical Patch Update to all identified instances and verify successful patching across your environment. Within 30 days, conduct log forensics to assess whether exploitation occurred during the vulnerable window and perform security testing to confirm the attack surface has been eliminated.

MySQL Connector/Net CVE-2026-60193

EUVD-2026-46599 HIGH

Improper Access Control (CWE-284)

2026-07-21 oracle

GHSA-375g-qwp7-p447

Authentication Bypass Oracle Mysql Connectors Oracle Corporation

8.5

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.5 HIGH

AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

8.5 HIGH

Concur with Oracle: network-reachable but hard to exploit (AC:H) requiring some privilege (PR:L), no user interaction, and a scope change enabling full C/I/A takeover impacting other components.

3.1 AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 21, 2026 - 23:06 vuln.today

CVE Published

Jul 21, 2026 - 21:33 nvd

HIGH 8.5

DescriptionCVE.org

Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/Net). Supported versions that are affected are 9.7.0-9.7.1. Difficult to exploit vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Connectors. While the vulnerability is in MySQL Connectors, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of MySQL Connectors. CVSS 3.1 Base Score 8.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H).

AnalysisAI

Full takeover of Oracle MySQL Connector/Net (versions 9.7.0 and 9.7.1) is possible by a low-privileged network attacker who wins a high-complexity attack, with a scope change that lets the compromise significantly impact products beyond the connector itself. Oracle rates this CVSS 3.1 8.5 with high confidentiality, integrity, and availability impact, and it is addressed in the July 2026 Critical Patch Update. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Technical ContextAI

MySQL Connector/Net is Oracle's official ADO.NET-compatible data provider used by .NET/C

applications to connect to MySQL and MySQL-compatible databases. The flaw lives in the client-side connector library rather than the MySQL server, so the trust boundary crossed is the application process embedding the driver. The scope-change flag (S:C) in the CVSS vector indicates that exploiting the connector can affect resources beyond the vulnerable component's own security authority - for example the host application, other libraries, or downstream data consumers. No CWE was assigned in the source data, so the precise weakness class (e.g., deserialization, injection, or memory-safety in wire-protocol parsing) cannot be confirmed from the available intelligence; the 'multiple protocols' phrasing suggests more than one transport/authentication path can reach the vulnerable code.

RemediationAI

Upgrade MySQL Connector/Net to the fixed release delivered in the Oracle July 2026 Critical Patch Update; consult https://www.oracle.com/security-alerts/cpujul2026.html for the exact patched version, as the specific fix build is not enumerated in the available data (Patch available per vendor advisory - released patched version not independently confirmed here). Because the vulnerability is client-side, rebuild and redeploy every .NET application that bundles the affected 9.7.0/9.7.1 connector rather than only patching database servers. Until patched, reduce exposure by ensuring applications connect only to trusted, authenticated MySQL endpoints over TLS (preventing a rogue or man-in-the-middle server from delivering a malicious response), restricting outbound database connectivity to known hosts via network egress rules, and running the application process with least privilege to blunt the scope-change impact; the trade-off is that strict endpoint pinning and egress filtering can break legitimate dynamic or multi-tenant database connectivity and must be tested against your deployment topology.