What is the CVSS score of CVE-2026-60194?

CVE-2026-60194 has a CVSS 3.1 base score of 4.9 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.4%.

MySQL Server CVE-2026-60194

EUVD-2026-46600 MEDIUM

Improper Access Control (CWE-284)

2026-07-21 oracle

GHSA-p6px-2vmw-9jf5

Oracle Mysql Server Mysql Cluster Authentication Bypass Red Hat

4.9

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

4.9 MEDIUM

AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

4.9 MEDIUM

Network-reachable DoS requiring high privileges with no confidentiality or integrity impact, consistent with Oracle's provided vector.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Red Hat

4.9 MEDIUM

qualitative

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 02:15 vuln.today

DescriptionCVE.org

Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: JSON Duality). Supported versions that are affected are MySQL Server: 9.7.0-9.7.1; MySQL Cluster: 9.7.0-9.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).

AnalysisAI

Denial of service in MySQL Server and MySQL Cluster 9.7.0-9.7.1 allows a high-privileged network attacker to cause a complete hang or repeatable crash of the database server via the JSON Duality component. The vulnerability is rated CVSS 4.9, with the PR:H requirement substantially limiting real-world exposure to authenticated administrators or compromised high-privilege accounts. No public exploit code or active exploitation has been identified at time of analysis.

Technical ContextAI

The affected component is MySQL's JSON Duality feature, introduced in the 9.x series, which exposes relational tables as JSON document views, allowing bidirectional reads and writes through a JSON interface over standard MySQL protocols. CPE identifiers cpe:2.3:a:oracle_corporation:mysql_server and cpe:2.3:a:oracle_corporation:mysql_cluster confirm Oracle's MySQL Server and Cluster product lines as affected. The CWE is listed as N/A, meaning Oracle has not disclosed the specific root cause class - the underlying defect (e.g., uncontrolled resource consumption, null pointer dereference, or logic error in JSON Duality view processing) is not confirmed from available data. The vulnerability is reachable via multiple MySQL protocols, including the classic MySQL Protocol and the X Protocol.

RemediationAI

Apply Oracle's Critical Patch Update for July 2026, available at https://www.oracle.com/security-alerts/cpujul2026.html. An exact patched version number beyond 9.7.1 is not independently confirmed from the available advisory reference - administrators must consult the Oracle CPU directly to identify the specific upgrade target. As compensating controls where immediate patching is not feasible, restrict high-privilege MySQL account access to known, monitored host IP ranges using MySQL's account host restrictions or network-layer firewall rules; this limits which systems can deliver the triggering request, though it does not eliminate the vulnerability. Additionally, audit and minimize the number of accounts holding SUPER or equivalent high-level privileges, as PR:H is the binding constraint for exploitation.