What is the CVSS score of CVE-2026-60317?

CVE-2026-60317 has a CVSS 3.1 base score of 7.4 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.3%.

Which versions of MySQL Connector/Net are affected by CVE-2026-60317?

Oracle MySQL Connectors (Connector/Net versions 9.7.0-9.7.1) contain an authentication bypass vulnerability allowing remote, unauthenticated attackers to read, create, delete, and modify all database…

How to fix or mitigate CVE-2026-60317?

Within 24 hours, audit all systems and applications running MySQL Connector/Net versions 9.7.0 or 9.7.1, prioritizing production environments and systems processing sensitive data (PII, financial information, health records). Within 7 days, implement interim mitigations including network segmentation to restrict database connector traffic to known-good database servers only, enable comprehensive SQL query auditing, activate authentication attempt logging, and deploy Web Application Firewall (WAF) rules to block anomalous patterns if connectors are exposed via APIs. Within 30 days, upgrade affected systems to version 9.7.2 or later (once released by Oracle), monitor vendor security advisories monthly for patch availability, and evaluate preemptive migration to alternative libraries (MySQL Connector/J or Connector/C) if a patched version is not released within 60 days of this advisory.

MySQL Connector/Net CVE-2026-60317

EUVD-2026-46732 HIGH

Improper Access Control (CWE-284)

2026-07-21 oracle

GHSA-4g79-g5hq-5j9f

Authentication Bypass Oracle Mysql Connectors Oracle Corporation

7.4

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

7.4 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

vuln.today AI

7.4 HIGH

Network-reachable and unauthenticated (AV:N/PR:N) but vendor-confirmed difficult to exploit (AC:H); full data read and tamper (C:H/I:H) with no availability effect (A:N).

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 21, 2026 - 22:18 vuln.today

CVE Published

Jul 21, 2026 - 21:34 cve.org

HIGH 7.4

DescriptionCVE.org

Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/Net). Supported versions that are affected are 9.7.0-9.7.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Connectors. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all MySQL Connectors accessible data as well as unauthorized access to critical data or complete access to all MySQL Connectors accessible data. CVSS 3.1 Base Score 7.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N).

AnalysisAI

Data compromise in Oracle MySQL Connectors (Connector/Net component) versions 9.7.0 through 9.7.1 allows a remote, unauthenticated attacker with network access via multiple protocols to read, create, delete, or modify all data accessible to the connector. Tagged as an Authentication Bypass, the flaw carries a CVSS 3.1 base score of 7.4 with full confidentiality and integrity impact but no availability impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, and the high attack complexity (AC:H) tempers real-world exploitability.

Technical ContextAI

MySQL Connector/Net is Oracle's fully managed ADO.NET driver used by .NET and .NET Core/.NET 5+ applications to connect to MySQL databases. The affected component handles client-side connection, authentication handshaking, and data transport between the application and the database server. The 'Authentication Bypass' tag combined with the CVSS profile (PR:N, C:H/I:H) suggests a weakness in how the connector validates the identity of the server or handles the authentication/handshake exchange, potentially class-consistent with improper authentication (CWE-287) or improper certificate/server validation. The specific CWE was reported as N/A by Oracle, so the exact root-cause class is not confirmed. The CPE cpe:2.3:a:oracle_corporation:mysql_connectors covers the connector product line, with Oracle scoping the affected releases to 9.7.0-9.7.1.

RemediationAI

Apply the fixed release delivered in the Oracle Critical Patch Update of July 2026; consult https://www.oracle.com/security-alerts/cpujul2026.html for the exact patched Connector/Net version and upgrade past the affected 9.7.0-9.7.1 range (Patch available per vendor advisory - the precise fixed version should be confirmed directly from the CPU matrix as it was not enumerated in the available data). Because the flaw is in the client connector rather than the MySQL server, remediation means updating the connector library shipped inside each affected .NET application and redeploying those applications; a server-side patch alone will not address it. As compensating controls until the update is rolled out, enforce strict TLS with full server certificate and hostname validation on all MySQL connections (SslMode=VerifyFull) to reduce the risk of a rogue or intercepting server exploiting the handshake weakness, and restrict application-to-database connectivity to trusted network segments so an attacker cannot easily position on the connection path; note these controls mitigate but may not fully eliminate the underlying bypass, and forcing VerifyFull can break connections relying on self-signed or misconfigured certificates.