MySQL Server CVE-2026-60324

The attacker must hold a valid low-privilege database account on the target MySQL Server or MySQL Cluster instance (CVSS PR:L). No special database roles, DBA privileges, or administrative access are required. The target must be running MySQL Server or MySQL Cluster version 9.7.0 or 9.7.1 specifically; no non-default configuration or optional feature enablement is stated as a prerequisite - the Optimizer is a core component active in all deployments. The attack is reachable via any supported protocol (classic MySQL protocol port 3306, X Protocol port 33060, or others), provided network access exists. Exploitation is limited by the credential requirement: unauthenticated attackers cannot exploit this vulnerability. Scope change does not occur - impact is confined to the target MySQL instance.

The CVSS 3.1 score of 6.5 with vector AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H accurately captures the risk profile: network-reachable, low complexity, but gated behind low-privilege authentication. The sole impact is availability (A:H), meaning confidentiality and integrity are fully unaffected, which constrains the blast radius. The 'easily exploitable' language from Oracle and AC:L both suggest that any authenticated database user - including application accounts - can reliably reproduce the crash, making insider-threat and post-authentication scenarios meaningful. No EPSS data was provided in available intelligence, and the vulnerability is absent from the CISA KEV catalog, so active exploitation is not confirmed. No public POC has been identified. Real-world priority is moderate: the attack requires at least one valid credential, limiting opportunistic exploitation, but in multi-tenant database environments or SaaS platforms where low-privilege accounts are widely distributed, the DoS impact can be severe. The narrow version range (9.7.0-9.7.1 only) limits the overall population of exposed systems.

An attacker who has obtained low-privilege MySQL credentials - through phishing, credential stuffing, or a compromised application account - connects to an exposed MySQL 9.7.x instance over the standard MySQL protocol and submits a specially crafted SQL query targeting an edge case in the Optimizer component. The server enters a hang or crashes, making the database unavailable to all connected clients and triggering downtime for dependent applications. Because no POC is publicly available, precise query construction is not confirmed, but the 'easily exploitable' and AC:L characterization indicates limited trial-and-error would be needed.