MySQL Server CVE-2026-60194

Exploitation requires an authenticated session with high-level database privileges (PR:H per CVSS vector), which in MySQL context typically means SUPER, SYSTEM_VARIABLES_ADMIN, or equivalent administrative grants - standard application-user accounts with limited grants are insufficient. Network access to the MySQL Server or Cluster instance via any supported protocol (MySQL Protocol, X Protocol, or others) is required (AV:N). The vulnerability is specific to the JSON Duality component introduced in MySQL 9.x; instances running older major versions (e.g., 8.0, 8.4) are not affected. No user interaction is required (UI:N). Exploitation is bounded by the high-privilege credential requirement - organizations enforcing least-privilege access policies are substantially protected against external exploitation, with residual risk from insider threat or credential compromise.

The CVSS 4.9 score reflects a meaningful availability impact tempered heavily by the PR:H requirement - exploitation demands a high-privilege authenticated session, restricting the realistic threat to malicious insiders, compromised DBA credentials, or lateral movement by an attacker who has already achieved privileged database access. The attack vector is network (AV:N) with low complexity (AC:L), meaning no special conditions or race conditions are required once credentials are in hand. Impact is strictly limited to availability (A:H); no confidentiality or integrity exposure exists per the vector. No EPSS score, CISA KEV listing, or POC code is available to further calibrate exploitation likelihood. In practice, the risk is low for organizations with proper privilege management, but noteworthy for environments where multiple users hold DBA-equivalent grants or where credential hygiene is weak.

An attacker with a high-privilege MySQL account - such as a compromised DBA credential or a malicious insider - connects to the database server over the network and issues a crafted query or operation targeting a JSON Duality view, triggering an unhandled condition in the JSON Duality component that causes the server to hang or crash. Because attack complexity is low (AC:L), no timing, race condition, or bypass is required - the trigger is repeatable and reliable once credentials and network access are established. No public exploit code has been identified at time of analysis.