What is the CVSS score of CVE-2026-60195?

CVE-2026-60195 has a CVSS 3.1 base score of 4.9 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.4%.

MySQL Server CVE-2026-60195

EUVD-2026-46601 MEDIUM

Improper Access Control (CWE-284)

2026-07-21 oracle

GHSA-xvj5-hp76-xww4

Oracle Mysql Server Mysql Cluster Authentication Bypass Red Hat

4.9

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

4.9 MEDIUM

AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

4.9 MEDIUM

Network-accessible DoS requiring high-privilege credentials confirms AV:N and PR:H; purely availability impact with no confidentiality or integrity effect justifies C:N/I:N/A:H.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Red Hat

4.9 MEDIUM

qualitative

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 02:14 vuln.today

CVE Published

Jul 21, 2026 - 21:33 nvd

MEDIUM 4.9

DescriptionCVE.org

Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: JSON Duality). Supported versions that are affected are MySQL Server: 9.7.0-9.7.1; MySQL Cluster: 9.7.0-9.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).

AnalysisAI

Denial of service in Oracle MySQL Server and MySQL Cluster 9.7.0-9.7.1 allows a high-privileged authenticated attacker to cause a complete, repeatable crash or hang of the database service by exploiting a flaw in the Server: JSON Duality component over any supported network protocol. The vulnerability is rated medium severity (CVSS 4.9) due to the high privilege prerequisite, limiting real-world exposure primarily to environments where privileged credentials have been compromised or where insider threat is a concern. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.

Technical ContextAI

MySQL's JSON Duality feature, introduced in MySQL 8.x and extended through the 9.x release family, allows relational tables to be exposed simultaneously as JSON documents via duality views, bridging structured relational storage with flexible JSON access patterns. The affected component - Server: JSON Duality - processes these dual-representation queries and is exposed to all connected clients with sufficient privilege. The vulnerability exists specifically in MySQL Server 9.7.0-9.7.1 and MySQL Cluster 9.7.0-9.7.1, confirmed by CPE strings cpe:2.3:a:oracle_corporation:mysql_server and cpe:2.3:a:oracle_corporation:mysql_cluster. No CWE is assigned by Oracle, leaving the precise root cause class unspecified; however, the described outcome (hang or frequently repeatable crash) is consistent with unhandled edge cases in JSON parsing or duality view resolution - patterns commonly associated with null pointer dereferences, assertion failures, or resource exhaustion in query processing paths. Multiple protocols are confirmed as viable attack vectors, consistent with MySQL's support for TCP/IP, Unix sockets (where applicable), and named pipe connections.

RemediationAI

Oracle has addressed this vulnerability as part of the July 2026 Critical Patch Update; organizations should consult the advisory at https://www.oracle.com/security-alerts/cpujul2026.html to identify the exact patched release version and apply the appropriate update. No specific patched version number beyond 9.7.1 is independently confirmed from the available data, so the CPU advisory is the authoritative source for upgrade targets. As a compensating control prior to patching, restrict network access to MySQL instances to only authorized high-privileged accounts through firewall rules or network segmentation, reducing the attack surface by limiting which hosts can establish privileged database sessions. Additionally, audit and minimize high-privileged MySQL account grants - removing unnecessary DBA-level roles reduces the number of credentials that could be leveraged. If the JSON Duality feature is not operationally required by applications, consider restricting or auditing its use through privilege controls, though disabling it entirely may require application-level changes and should be tested for regression.