What is the CVSS score of CVE-2026-60316?

CVE-2026-60316 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of MySQL Server are affected by CVE-2026-60316?

Oracle MySQL Server versions 8.4.0-8.4.10 and 9.7.0-9.7.1 and MySQL Cluster versions 8.0.0-8.0.47, 8.4.0-8.4.10, and 9.7.0-9.7.1 contain a vulnerability in the Server: X Plugin component enabling…. A patch is available.

How to fix or mitigate CVE-2026-60316?

Within 24 hours, identify all MySQL Server and MySQL Cluster systems in your infrastructure and document which instances run vulnerable versions (MySQL Server 8.4.0-8.4.10 or 9.7.0-9.7.1; MySQL Cluster 8.0.0-8.0.47, 8.4.0-8.4.10, or 9.7.0-9.7.1). Within 7 days, implement interim protections: disable the X Plugin component if not operationally required, restrict network access to MySQL services from trusted hosts only, enforce principle of least privilege for database administrator and service accounts, and enable comprehensive audit logging of database activity. Within 30 days, monitor Oracle's security advisories for vendor patch availability, coordinate with application teams on patch testing and deployment timelines, and maintain updated recovery and backup procedures.

MySQL Server CVE-2026-60316

EUVD-2026-46731 HIGH

Improper Access Control (CWE-284)

2026-07-21 oracle

GHSA-569j-46cc-m4j3

Authentication Bypass Oracle Red Hat Mysql Cluster Mysql Server Suse Oracle Corporation

7.2

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

7.2 HIGH

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.2 HIGH

Network-reachable X Plugin, low complexity, no user interaction, but requires high database privileges (PR:H); full server takeover gives C:H/I:H/A:H with no scope change.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

HIGH

qualitative

Red Hat

7.2 HIGH

qualitative

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 21, 2026 - 22:18 vuln.today

CVE Published

Jul 21, 2026 - 21:34 cve.org

HIGH 7.2

DescriptionCVE.org

Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: X Plugin). Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and 9.7.0-9.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster. Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Full takeover of Oracle MySQL Server and MySQL Cluster is possible through the Server: X Plugin component, allowing a high-privileged attacker with network access via multiple protocols to compromise confidentiality, integrity, and availability. Affected builds include MySQL Server 8.4.0-8.4.10 and 9.7.0-9.7.1, plus MySQL Cluster 8.0.0-8.0.47, 8.4.0-8.4.10 and 9.7.0-9.7.1. There is no public exploit identified at time of analysis and the flaw is not on the CISA KEV list, though Oracle rates it as easily exploitable once the required high privileges are held.

Technical ContextAI

The vulnerability resides in the X Plugin, the MySQL server component that implements the X Protocol (the mysqlx interface, default TCP port 33060) used by the X DevAPI and MySQL Shell for document-store and CRUD-style operations layered over classic SQL. Oracle's note that the flaw is reachable via multiple protocols indicates the underlying defect is in the X Plugin's request handling rather than tied to a single transport. No CWE was assigned in the source data, so the precise root-cause class (memory corruption, injection, or logic flaw) cannot be confirmed; the outcome Oracle describes is complete takeover of the server. The affected CPE set is limited to Oracle's mysql_server and mysql_cluster products, confirming this is the upstream Oracle distribution rather than a fork.

RemediationAI

Apply the Oracle Critical Patch Update for July 2026, which is the vendor fix for this issue; consult https://www.oracle.com/security-alerts/cpujul2026.html for the exact patched build corresponding to your MySQL Server or MySQL Cluster train (an exact fixed version number was not included in the input data and should be taken from the CPU matrix). As a compensating control until patching, restrict exposure of the X Protocol interface: disable the X Plugin if the X DevAPI/document store is unused (set mysqlx=OFF or start with --skip-mysqlx), or firewall/bind the mysqlx port (default 33060) so it is reachable only from trusted application hosts - the trade-off is loss of X DevAPI and MySQL Shell X-protocol connectivity for legitimate clients. Because exploitation requires high privileges, also rotate and minimize high-privilege accounts, enforce least privilege, and audit administrative connections. These controls reduce reachability and the pool of accounts that could trigger the flaw but do not substitute for the vendor patch.