MySQL Connector/Net CVE-2026-60317

Requires the target application to use MySQL Connector/Net version 9.7.0 or 9.7.1 specifically; other connector families (Connector/J, Connector/Python, ODBC, C/C++) and other version lines are outside the stated scope. Per CVSS AV:N/PR:N/UI:N the attack is remote and needs no credentials or user interaction, but AC:H means it is 'difficult to exploit' and depends on the attacker meeting specialized conditions - realistically network positioning to intercept, redirect, or impersonate the MySQL server the connector talks to, since this is a client-side connector reached 'via multiple protocols.' Limiting factors: the narrow affected version band (9.7.0-9.7.1), the client-side nature requiring an attacker on or influencing the connection path, and the high attack complexity all substantially reduce realistic exploitability despite the unauthenticated network vector.

The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N) shows a network-reachable, unauthenticated attack requiring no user interaction, but Oracle explicitly labels it 'difficult to exploit' and encodes this as AC:H, which is the single largest limiting factor. The high confidentiality and integrity impact (full data read and modification) justifies the 7.4 High rating, while the absence of availability impact (A:N) means no denial-of-service dimension. No EPSS score was provided in the input, and the CVE is not in CISA KEV, so there is no evidence of active exploitation. No POC was referenced, so exploitation status is 'no public exploit identified at time of analysis.' Net assessment: a genuinely high-severity data-exposure/tampering issue, but the high attack complexity and lack of any exploitation signal place it below actively-exploited network flaws in patch priority - it warrants prompt remediation on affected 9.7.x deployments rather than emergency response. Note: because this is a client-side connector, 'network access' realistically implies an attacker positioned to influence the connection or act as/intercept the server, which further constrains practical exploitation beyond the raw PR:N metric.

An attacker able to intercept or impersonate the MySQL server on the network path (for example via ARP/DNS spoofing or a compromised intermediary) leverages the connector's authentication/validation weakness so that a vulnerable .NET application's Connector/Net client trusts the malicious endpoint or bypasses expected authentication. This lets the attacker read or tamper with all data the connector can access. No public POC is referenced, and the high attack complexity means the attacker must satisfy specific timing or positioning conditions to succeed.