Oracle MySQL CVE-2026-60332

Exploitation requires the attacker to already have a local logon session on the underlying infrastructure (physical or virtual host) where MySQL Server or MySQL Cluster executes - the AV:L vector confirms no network-based exploitation path exists. The attacker must hold high database or OS-level privileges (PR:H), meaning a low-privileged OS user or unauthenticated remote attacker cannot trigger this vulnerability. The exploit conditions are classified as difficult (AC:H), implying a race condition, specific environment state, or configuration dependency must be met - the precise triggering condition is not disclosed by Oracle. The Group Replication GCS component must be active, meaning this only affects MySQL deployments using Group Replication; standalone non-replicated MySQL instances are not exposed through this component. Limiting factors: no remote attack path, mandatory pre-existing high privilege, high exploitation complexity, and feature-specific scope (Group Replication must be configured and running).

The raw CVSS base score of 6.4 understates the theoretical impact - C:H/I:H/A:H maps to full instance takeover - but the three constraining metrics (AV:L, AC:H, PR:H) together make opportunistic or remote exploitation effectively impossible without significant pre-existing access. An attacker must already possess high-privileged OS or database-level access to the specific host running MySQL, must overcome difficult exploitation conditions (AC:H, possibly a race condition, specific timing, or environment state), and has no network-level entry point. There is no EPSS score available in the provided data to quantify exploitation probability. There is no CISA KEV listing, meaning confirmed active exploitation has not been observed. No POC or exploit code has been identified. SSVC inference: exploitation is technically demanding and requires insider or post-compromise position; automatable exploitation is not plausible given AV:L/AC:H/PR:H. Real-world priority is LOW for organizations without threat models involving privileged insiders or post-compromise lateral movement targeting database infrastructure. Priority rises for high-value MySQL Cluster deployments where GCS-based privilege escalation could pivot to clustered data across multiple nodes.

A database administrator or compromised service account with high OS-level privileges on the MySQL host triggers a flaw in the GCS component during Group Replication communication processing, possibly by manipulating cluster state or sending malformed GCS messages at a specific timing window. Successful exploitation under these difficult conditions results in full takeover of the MySQL Server or Cluster instance, granting the attacker control over all stored data, replication streams, and database availability. No public POC exists at time of analysis; exploitation complexity (AC:H) suggests this is not a trivially reproducible scenario.