What is the CVSS score of CVE-2026-60315?

CVE-2026-60315 has a CVSS 3.1 base score of 8.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H. EPSS exploitation probability: 0.2%.

Which versions of Oracle MySQL Server are affected by CVE-2026-60315?

Oracle MySQL Server versions 8.4.0-8.4.10 and 9.7.0-9.7.1 contain a critical vulnerability in the X Plugin component that enables unauthenticated remote attackers to cause complete database service…. A patch is available.

How to fix or mitigate CVE-2026-60315?

Within 24 hours: Inventory all MySQL Server instances running versions 8.4.0-8.4.10, 9.7.0-9.7.1, or affected MySQL Cluster versions (8.0.0-8.0.47, 8.4.0-8.4.10, 9.7.0-9.7.1); disable the X Plugin component if operationally feasible by setting mysqlx=OFF in the MySQL configuration file. Within 7 days: Implement network segmentation to restrict access to the X Plugin port (default 33060) to trusted internal networks only and enable detailed connection logging to detect reconnaissance activity. Within 30 days: Monitor Oracle's security advisories for patch availability; develop and test upgrade pathways to unaffected versions (8.4.11+, 9.7.2+ or equivalent cluster versions) for deployment once patches are released.

Oracle MySQL Server CVE-2026-60315

EUVD-2026-46730 HIGH

Information Exposure (CWE-200)

2026-07-21 oracle

GHSA-47wc-32xv-3x4v

Information Disclosure Oracle Red Hat Mysql Cluster Mysql Server Suse Oracle Corporation

8.2

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.2 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H

vuln.today AI

8.2 HIGH

Unauthenticated low-complexity network attack on the X Plugin gives PR:N/AC:L/AV:N; impact is complete DoS (A:H) with only partial data read (C:L) and no integrity effect (I:N).

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N

SUSE

HIGH

qualitative

Red Hat

8.2 HIGH

qualitative

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 21, 2026 - 22:18 vuln.today

CVE Published

Jul 21, 2026 - 21:34 cve.org

HIGH 8.2

DescriptionCVE.org

Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: X Plugin). Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and 9.7.0-9.7.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster and unauthorized read access to a subset of MySQL Server, MySQL Cluster accessible data. CVSS 3.1 Base Score 8.2 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H).

AnalysisAI

Remote unauthenticated denial-of-service and partial information disclosure affects Oracle MySQL Server 8.4.0-8.4.10 and 9.7.0-9.7.1 (and MySQL Cluster 8.0.0-8.0.47, 8.4.0-8.4.10, 9.7.0-9.7.1) through the Server: X Plugin component. An attacker with only network access, using multiple protocols, can trigger a hang or repeatable crash (complete DoS) and read a subset of accessible data, carrying an Oracle-assigned CVSS 3.1 score of 8.2. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Technical ContextAI

The flaw resides in the MySQL X Plugin, the server component that implements the X Protocol (MySQL Document Store / X DevAPI), which by default listens on TCP port 33060 and enables NoSQL-style and asynchronous document/CRUD access to the database. The CPE data confirms two affected products from Oracle: mysql_server and mysql_cluster. Oracle publishes no CWE (CWE: N/A), but the described behavior - an unauthenticated protocol handler that can be driven into a hang/crash and made to leak a subset of data - is consistent with an input-validation or resource-handling defect in X Plugin's pre-authentication message parsing, a classic root cause for network-facing protocol front-ends.

RemediationAI

Apply the fixes from Oracle's July 2026 Critical Patch Update (https://www.oracle.com/security-alerts/cpujul2026.html); Oracle CPUs deliver the fix in the next quarterly release above the affected ranges, so upgrade MySQL Server past 8.4.10 / 9.7.1 and MySQL Cluster past 8.0.47 / 8.4.10 / 9.7.1 to the CPU-patched versions (exact patched build numbers are enumerated in the CPU advisory and should be taken from it rather than assumed). If immediate patching is not possible, the most direct compensating control is to reduce X Plugin exposure: disable the X Plugin if the X Protocol/Document Store is not used (set mysqlx=OFF or start with --skip-mysqlx), which removes the attack surface entirely but breaks any application using X DevAPI/Document Store on port 33060; alternatively, firewall or restrict access to TCP port 33060 so only trusted application hosts can reach it, which preserves functionality for allow-listed clients while blocking untrusted network attackers. Because exploitation is unauthenticated and pre-auth, network-level restriction is the key mitigation until patched.