What is the CVSS score of CVE-2026-60585?

CVE-2026-60585 has a CVSS 3.1 base score of 6.6 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Is there a patch available for CVE-2026-60585?

Yes, a patch is available for CVE-2026-60585. Update the affected software to the latest version immediately.

MySQL Server CVE-2026-60585

EUVD-2026-46947 MEDIUM

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-5wmq-h5x7-m9vv

Oracle Authentication Bypass Mysql Server Mysql Cluster Red Hat Suse

6.6

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

6.6 MEDIUM

AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

6.6 MEDIUM

Network reachability via replication protocol supports AV:N; PR:H and AC:H confirmed by high-privilege requirement and Oracle's 'difficult to exploit' characterization; full takeover yields C:H/I:H/A:H with no scope change.

3.1 AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

MEDIUM

qualitative

Red Hat

6.6 MEDIUM

qualitative

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

High

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 09:06 vuln.today

CVE Published

Jul 21, 2026 - 22:17 nvd

MEDIUM 6.6

DescriptionCVE.org

Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication). Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and 9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster. Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 6.6 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Full takeover of Oracle MySQL Server and MySQL Cluster is achievable through the Server: Replication component by a highly privileged network attacker who can satisfy difficult exploitation conditions. Affected deployments include MySQL Server 8.4.0-8.4.10 and 9.7.0-9.7.1, as well as MySQL Cluster 8.0.0-8.0.47, 8.4.0-8.4.10, and 9.7.0-9.7.1, with complete confidentiality, integrity, and availability impact upon successful exploitation. Oracle disclosed this through the July 2026 Critical Patch Update; no public exploit identified at time of analysis.

Technical ContextAI

The vulnerability resides in the Server: Replication component of Oracle MySQL, which manages binary log streaming and data synchronization between primary and replica database nodes over multiple protocols (typically TCP). The affected code path is reachable via network access, consistent with the AV:N CVSS metric. Oracle has not assigned a CWE, leaving the root cause class unspecified; however, the full-impact triad (C:H/I:H/A:H) with scope unchanged (S:U) suggests a critical flaw within the replication subsystem itself - possibly memory corruption, a logic error in replication protocol handling, or a privilege escalation within the component. Affected products confirmed via ENISA EUVD-2026-46947 span MySQL Server 8.4.x and 9.7.x and MySQL Cluster 8.0.x through 9.7.x, covering both the LTS and innovation release tracks.

RemediationAI

Apply Oracle's July 2026 Critical Patch Update advisory available at https://www.oracle.com/security-alerts/cpujul2026.html; the specific patched version numbers are not independently confirmed from the available data and must be retrieved directly from that advisory. As an immediate compensating control, restrict network access to MySQL replication ports (default TCP 3306 and any configured replication-specific ports) to only trusted replica hosts using host-based firewall rules or MySQL's bind-address and host-based user account restrictions - this directly limits the AV:N attack vector but does not eliminate it if replication peers are themselves compromised. Audit and revoke unnecessary high-privileged MySQL accounts, particularly those with REPLICATION SLAVE, SUPER, or SYSTEM_USER privileges, to address the PR:H prerequisite directly; this is the most effective compensating control as it removes the privilege tier required for exploitation. On instances where replication is not operationally required, disabling the replication subsystem entirely eliminates the attack surface, though this has significant operational implications for replica-dependent read-scaling or HA architectures.