What is the CVSS score of CVE-2026-60315?

CVE-2026-60315 has a CVSS 3.1 base score of 8.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H. EPSS exploitation probability: 0.2%.

How to fix or mitigate CVE-2026-60315?

Within 24 hours: Inventory all MySQL Server instances running versions 8.4.0-8.4.10, 9.7.0-9.7.1, or affected MySQL Cluster versions (8.0.0-8.0.47, 8.4.0-8.4.10, 9.7.0-9.7.1); disable the X Plugin component if operationally feasible by setting mysqlx=OFF in the MySQL configuration file. Within 7 days: Implement network segmentation to restrict access to the X Plugin port (default 33060) to trusted internal networks only and enable detailed connection logging to detect reconnaissance activity. Within 30 days: Monitor Oracle's security advisories for patch availability; develop and test upgrade pathways to unaffected versions (8.4.11+, 9.7.2+ or equivalent cluster versions) for deployment once patches are released.

Oracle MySQL Server CVE-2026-60315

EUVD-2026-46730 HIGH

Information Exposure (CWE-200)

2026-07-21 oracle

GHSA-47wc-32xv-3x4v

Information Disclosure Oracle Red Hat Mysql Cluster Mysql Server Suse Oracle Corporation

8.2

CVSS 3.1 · Vendor: oracle

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Reach MySQL X Plugin port 33060
Delivery

Send crafted X Protocol messages
Exploit

Trigger hang or repeatable crash
Execution

Read subset of accessible data
Impact

Complete denial of service

Vulnerability Assessment

Weakness	CWE CWE-200 OWASP Top 10:2025 A01:2025 - Broken Access Control ASVS 5.0 V14 - Data Protection Data exposure prevention MITRE ATT&CK 2 techniques across 2 tactics: Collection, Discovery The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	Exploitation requires that the MySQL X Plugin be enabled and its X Protocol listener (default TCP 33060) be network-reachable by the attacker - this is the exact component named in the CVE. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), no authentication and no user interaction are needed, and Oracle states multiple protocols can be used, so against a default MySQL 8.4/9.7 install with X Plugin active there are no special preconditions beyond network reachability. What limits exploitation: instances with the X Plugin disabled (mysqlx=OFF / --skip-mysqlx) or with port 33060 firewalled from untrusted networks are not exposed, and only the specific listed versions (MySQL Server 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster 8.0.0-8.0.47, 8.4.0-8.4.10, 9.7.0-9.7.1) are affected.
Impact	The signals are moderately consistent and point to a genuine priority for internet- or network-exposed MySQL X Protocol endpoints. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H) describes low-complexity, unauthenticated, network exploitation with high availability impact and low confidentiality impact and no integrity impact - Oracle explicitly calls it 'easily exploitable.' The dominant impact is availability (complete DoS), with only a subset of data readable, so this is primarily an uptime/reliability risk rather than a data-breach risk. No EPSS score was provided in the input, so exploitation probability cannot be quantified; there is no POC and no KEV listing, indicating no confirmed active exploitation. The main mitigating factor is exposure: risk is high only where the X Plugin (port 33060) is reachable by untrusted networks; databases with X Plugin disabled or firewalled off are largely unaffected in practice.
Exploit ScenarioDerived	An attacker who can reach the MySQL X Protocol port (33060) sends crafted X Plugin protocol messages without any credentials, driving the server into a hang or repeatable crash and taking the database completely offline, while also reading a limited subset of accessible data. Because attack complexity is low and no authentication or user interaction is required, this can be scripted against exposed instances; no public POC has been identified at time of analysis.

This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).

Patch available 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jul 21, 2026

Remote unauthenticated denial-of-service and partial information disclosure affects Oracle MySQL Server 8.4.0-8.4.10 and 9.7.0-9.7.1 (and MySQL Cluster 8.0.0-8.0.47, 8.4.0-8.4.10, 9.7.0-9.7.1) through the Server: X Plugin component. An attacker with only network access, using multiple protocols, can trigger a hang or repeatable crash (complete DoS) and read a subset of accessible data, carrying an Oracle-assigned CVSS 3.1 score of 8.2. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.

RemediationAI

Apply the fixes from Oracle's July 2026 Critical Patch Update (https://www.oracle.com/security-alerts/cpujul2026.html); Oracle CPUs deliver the fix in the next quarterly release above the affected ranges, so upgrade MySQL Server past 8.4.10 / 9.7.1 and MySQL Cluster past 8.0.47 / 8.4.10 / 9.7.1 to the CPU-patched versions (exact patched build numbers are enumerated in the CPU advisory and should be taken from it rather than assumed). If immediate patching is not possible, the most direct compensating control is to reduce X Plugin exposure: disable the X Plugin if the X Protocol/Document Store is not used (set mysqlx=OFF or start with --skip-mysqlx), which removes the attack surface entirely but breaks any application using X DevAPI/Document Store on port 33060; alternatively, firewall or restrict access to TCP port 33060 so only trusted application hosts can reach it, which preserves functionality for allow-listed clients while blocking untrusted network attackers. Because exploitation is unauthenticated and pre-auth, network-level restriction is the key mitigation until patched.

Affected VersionsENISA

MySQL Cluster 8.0.0-8.0.47

MySQL Cluster 8.4.0-8.4.10

MySQL Server 8.4.0-8.4.10

MySQL Server 9.7.0-9.7.1

MySQL Cluster 9.7.0-9.7.1

Affected Packages

euvd mysql_cluster no fix

euvd mysql_server no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 2 packages in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

The flaw resides in the MySQL X Plugin, the server component that implements the X Protocol (MySQL Document Store / X DevAPI), which by default listens on TCP port 33060 and enables NoSQL-style and asynchronous document/CRUD access to the database. The CPE data confirms two affected products from Oracle: mysql_server and mysql_cluster. Oracle publishes no CWE (CWE: N/A), but the described behavior - an unauthenticated protocol handler that can be driven into a hang/crash and made to leak a subset of data - is consistent with an input-validation or resource-handling defect in X Plugin's pre-authentication message parsing, a classic root cause for network-facing protocol front-ends.

Know when Mysql Server gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (oracle) PRIMARY 8.2 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H

vuln.today AI 8.2 HIGH

Unauthenticated low-complexity network attack on the X Plugin gives PR:N/AC:L/AV:N; impact is complete DoS (A:H) with only partial data read (C:L) and no integrity effect (I:N).

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N

SUSE HIGH

Red Hat 8.2 HIGH

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

High

DescriptionCVE.org

Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: X Plugin). Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and 9.7.0-9.7.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster and unauthorized read access to a subset of MySQL Server, MySQL Cluster accessible data. CVSS 3.1 Base Score 8.2 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H).

Executive ViewAI

Why It Matters

Oracle MySQL Server versions 8.4.0-8.4.10 and 9.7.0-9.7.1 contain a critical vulnerability in the X Plugin component that enables unauthenticated remote attackers to cause complete database service denial-of-service and access sensitive data. Organizations running these versions face operational disruption and potential data exposure, with no vendor patch currently available.

Business Impact: High

Compensating Controls

Disable MySQL X Plugin (set mysqlx=OFF in mysql.cnf) if operationally unnecessary; restrict network access to MySQL service ports (3306, 33060) via firewall rules to known, trusted application servers and administrative networks only; enable comprehensive audit logging for database connection attempts and monitor logs for abnormal service crashes or resource exhaustion patterns.

Threat Intelligence Overview

EPSS Score

0.2%

Top 84% exploitable

Prevalence

Ubiquitous

MySQL is one of the most widely deployed databases worldwide

Data Quality

5 sources

Confidence: Medium

EUVD

NVD

CVE.org

EPSS

Vulnrichment Vendor

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC No

EPSS 0.2%

Patch available Yes

Active threat No

Deciding rule

HIGH severity (CVSS 7.0-8.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision

Scheduled

Exploitation

None

System Exposure· derived

Open

Automatable

Yes

Human Impact

High

Technical Impact

Partial

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +41

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.