MySQL Server CVE-2026-60195

Exploitation requires a high-privileged MySQL account (PR:H) - such as root or a DBA-equivalent user - with network connectivity to the MySQL Server or Cluster instance. The attacker must be able to interact with the Server: JSON Duality component, meaning the feature must be accessible within the target's MySQL configuration. The vulnerability is scoped exclusively to MySQL Server and MySQL Cluster versions 9.7.0 and 9.7.1; no earlier versions are listed as affected. No user interaction is required (UI:N), and attack complexity is low (AC:L), meaning exploitation is straightforward once privileged credentials are in hand. Primary limiting factors are: (1) the high privilege requirement - unauthenticated or low-privileged exploitation is not possible per the CVSS:3.1/PR:H vector; (2) the narrow affected version range (9.7.0-9.7.1 only); and (3) the impact is limited to availability - there is no confidentiality or integrity exposure.

The CVSS 3.1 score of 4.9 (Medium) is appropriate here and the vector (AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H) accurately reflects the attack profile. The high privilege requirement (PR:H) is the dominant risk-limiting factor - exploitation is not achievable without control of a high-privileged MySQL account such as DBA or root. Attack complexity is low (AC:L) and no user interaction is needed, meaning that once credentials are obtained, exploitation is straightforward. The impact is purely availability-based: no confidentiality or integrity risk is present, making this a targeted DoS rather than a data breach vector. The vulnerability affects only versions 9.7.0-9.7.1, a narrow and very recent release window, which further constrains the exposed population. EPSS data is not available from the provided intelligence, and no KEV listing or public exploit code exists at time of analysis. Real-world risk priority should be moderate for organizations actively running MySQL 9.7.x - particularly those with externally accessible database endpoints or environments where privileged credential compromise is plausible - and low for organizations on earlier MySQL versions.

An attacker who has compromised a high-privileged MySQL account - through credential theft, phishing of a DBA, or lateral movement within an enterprise network - connects to the MySQL Server over any supported protocol and submits a crafted query or operation targeting the JSON Duality component. The request triggers a hang or repeatable crash of the MySQL service, causing a complete denial of service for all downstream applications depending on the database. Because Oracle describes the vulnerability as 'easily exploitable' despite the high privilege requirement, the trigger is likely a simple malformed or edge-case JSON Duality query rather than a complex exploit chain.