MySQL Server CVE-2026-60585

Exploitation requires the attacker to hold high-privileged MySQL credentials (PR:H), such as accounts granted REPLICATION SLAVE, SUPER, SYSTEM_USER, or equivalent administrative privileges - standard unprivileged or low-privileged database users cannot trigger this vulnerability. The Server: Replication component must be active and reachable, meaning replication must be configured or at minimum the replication subsystem must be loaded and network-accessible. Attack complexity is High (AC:H), indicating that conditions beyond attacker control - such as specific server state, race conditions, or precise protocol sequencing - must align for successful exploitation; Oracle's description explicitly characterizes the vulnerability as 'difficult to exploit.' Network access to the MySQL instance via one or more supported protocols is required. Key limiting factors: the high-privilege prerequisite sharply constrains the attacker population to insiders or those with prior deep-access compromise; the AC:H condition prevents reliable automated exploitation; and unauthenticated external attackers have no direct path to exploitation.

The CVSS 3.1 base score of 6.6 (AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H) reflects an important tension: while all three impact dimensions are High - representing full database server takeover - the prerequisites of High attack complexity (AC:H) and High required privileges (PR:H) dramatically constrain the realistic attacker population. An attacker must already control a high-privileged MySQL account (e.g., REPLICATION SLAVE, SUPER, or equivalent) and must overcome difficult technical conditions to trigger the flaw. This makes opportunistic, automated, or mass exploitation highly unlikely. No KEV listing is present and no public exploit has been identified at time of analysis; EPSS data is not available in the provided intelligence. The realistic threat model is an insider threat, a compromised high-privileged credential holder, or an attacker who has already achieved deep foothold. Oracle's own characterization of this as 'difficult to exploit' aligns with the AC:H and PR:H metrics. Despite the theoretical severity, well-hardened environments with enforced least-privilege MySQL accounts and restricted replication port access face materially lower risk than the base score alone suggests.

An attacker who has obtained high-privileged MySQL credentials - whether through credential theft, insider access, or prior compromise - connects to the target MySQL Server or Cluster over the network and sends specially crafted replication protocol messages to the Server: Replication component. The attacker must satisfy difficult technical preconditions (AC:H), such as specific server state, timing, or protocol sequencing, before the vulnerability triggers. Upon successful exploitation, the attacker achieves full control of the MySQL instance, including unrestricted read/write access to all databases and the ability to disrupt availability.