What is the CVSS score of CVE-2026-60586?

CVE-2026-60586 has a CVSS 3.1 base score of 7.7 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N. EPSS exploitation probability: 0.4%.

Which versions of MySQL Connector/J are affected by CVE-2026-60586?

Oracle MySQL Connector/J versions 9.7.0-9.7.1 contain an authentication bypass vulnerability enabling unauthorized database data disclosure via network access.

How to fix or mitigate CVE-2026-60586?

Within 24 hours, inventory all Java applications and services using MySQL Connector/J 9.7.0 or 9.7.1 and verify their production database scope. Within 7 days, prioritize upgrading all production systems to patched versions available in Oracle Critical Patch Update of July 2026; if immediate patching is blocked, deploy network segmentation to restrict connector-to-database communications to authorized hosts only. Within 30 days, complete full rollout of patched connector versions across development and non-production environments and validate functionality through regression testing.

MySQL Connector/J CVE-2026-60586

EUVD-2026-46948 HIGH

Missing Authentication for Critical Function (CWE-306)

2026-07-21 secalert_us@oracle.com

GHSA-7p69-9748-7pc9

Authentication Bypass Oracle Mysql Connectors

7.7

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

7.7 HIGH

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

vuln.today AI

7.7 HIGH

Network-reachable, low-complexity driver flaw needing an existing low-privilege foothold (PR:L); scope change (S:C) reflects cross-product impact; confidentiality-only (C:H, I:N, A:N) per the disclosure.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 07:29 vuln.today

CVE Published

Jul 21, 2026 - 22:17 nvd

HIGH 7.7

DescriptionCVE.org

Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/J). Supported versions that are affected are 9.7.0-9.7.1. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Connectors. While the vulnerability is in MySQL Connectors, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all MySQL Connectors accessible data. CVSS 3.1 Base Score 7.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N).

AnalysisAI

Unauthorized data disclosure in Oracle MySQL Connector/J (the official MySQL JDBC driver) versions 9.7.0 through 9.7.1 allows a low-privileged attacker with network access to compromise confidentiality, with a scope change that lets the attack significantly impact additional products beyond the connector itself. Fixed in the Oracle Critical Patch Update of July 2026 and tagged as an authentication bypass, the flaw carries a CVSS 3.1 score of 7.7 with high confidentiality impact and no integrity or availability effect. No public exploit identified at time of analysis, and there is no CISA KEV or EPSS signal in the provided data.

Technical ContextAI

MySQL Connector/J is Oracle's official Type 4 JDBC driver used by Java applications to connect to MySQL databases over the wire protocol (and, per the advisory, 'multiple protocols'). Because the driver sits between an application and its database, a defect in how it handles connections, authentication, or protocol data can expose data belonging to the calling application rather than just the driver - which is reflected in the CVSS scope change (S:C). No CWE was assigned in the source data, but the vendor 'Authentication Bypass' tag together with a confidentiality-only impact (C:H, I:N, A:N) points to a root cause in connection authentication or trust handling that permits reading data the attacker should not reach. Exact affected components are the 9.7.x release line (9.7.0 and 9.7.1) per Oracle's July 2026 Critical Patch Update.

RemediationAI

Upgrade MySQL Connector/J to the fixed release delivered in the Oracle Critical Patch Update of July 2026 (https://www.oracle.com/security-alerts/cpujul2026.html); the input does not name an exact fixed version number, so consult that advisory for the precise patched build rather than relying on an assumed version. In Java projects this means bumping the mysql-connector-j dependency in Maven/Gradle and redeploying affected applications. Until patched, reduce exposure by restricting which hosts can reach MySQL endpoints the vulnerable driver connects to, enforcing TLS and strict server-certificate/host verification on JDBC connections, and limiting the privileges of the database accounts the connector uses so a confidentiality breach yields less data - noting the trade-off that tightening host verification can break connections to servers with mismatched or self-signed certificates and must be tested before rollout. Because the flaw is tagged as an authentication bypass, also review connection-string trust settings against Oracle's guidance.