What is the CVSS score of CVE-2026-60314?

CVE-2026-60314 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.4%.

Which versions of Mysql Router are affected by CVE-2026-60314?

Oracle MySQL Router versions 8.4.0-8.4.10 and 9.7.0-9.7.1 contain a high-severity remote denial-of-service vulnerability that allows unauthenticated attackers to crash or hang the Router process,…

How to fix or mitigate CVE-2026-60314?

Within 24 hours, identify and prioritize all systems running Oracle MySQL Router versions 8.4.0-8.4.10 or 9.7.0-9.7.1 by business criticality. Within 7 days, implement network rate limiting and HTTP request filtering on affected routers, establish rapid incident response procedures for Router restarts, and establish a tracking mechanism for the July 2026 CPU release. Within 30 days, apply the July 2026 Critical Patch Update immediately upon availability to all affected systems.

Mysql Router CVE-2026-60314

EUVD-2026-46729 HIGH

Uncontrolled Resource Consumption (CWE-400)

2026-07-21 oracle

GHSA-mcf6-cwjw-4hq9

Denial Of Service Oracle Mysql Router Oracle Corporation

7.5

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Primary rating from Vendor (oracle) · only source for this CVE.

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 21, 2026 - 22:19 vuln.today

CVE Published

Jul 21, 2026 - 21:34 cve.org

HIGH 7.5

DescriptionCVE.org

Vulnerability in the MySQL Router product of Oracle MySQL (component: Router: General). Supported versions that are affected are 8.4.0-8.4.10 and 9.7.0-9.7.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise MySQL Router. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Router. CVSS 3.1 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).

AnalysisAI

Denial-of-service in Oracle MySQL Router (versions 8.4.0-8.4.10 and 9.7.0-9.7.1) allows a remote unauthenticated attacker to send crafted HTTP traffic that hangs or repeatedly crashes the Router process, causing a complete availability outage. The flaw is rated CVSS 7.5 with only availability impact (no data confidentiality or integrity loss) and is described by Oracle as 'easily exploitable.' As of this analysis there is no public exploit identified and it is not listed in CISA KEV; the fix ships in Oracle's July 2026 Critical Patch Update.