MySQL Connector/J CVE-2026-60586

Exploitation requires network access to a target running MySQL Connector/J versions 9.7.0 or 9.7.1 specifically (the 9.7.x line), and the attacker must already hold low privileges (CVSS PR:L) - so it is not fully unauthenticated despite the 'Authentication Bypass' tag, which appears to describe the flaw's effect rather than removing the PR:L prerequisite. The vendor notes exploitation is possible 'via multiple protocols,' broadening the reachable attack surface. Limiting factors: only the 9.7.0-9.7.1 releases are affected (earlier or later fixed builds are not), impact is confined to confidentiality (no data modification or denial of service), and the attacker needs an existing low-privilege position plus network reachability to the vulnerable component. The exact protocol conditions are not detailed in the Oracle CPU summary and should be confirmed against the advisory.

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N, score 7.7) indicates a network-reachable, low-complexity attack requiring only low privileges and no user interaction, with a scope change amplifying impact to other products - a genuinely serious profile for a data-confidentiality flaw. However, no EPSS score, KEV status, POC, or SSVC decision data was supplied, so real-world exploitation likelihood cannot be quantified from the input; the absence of these signals is a data gap, not evidence of low risk. A notable tension exists between the 'Authentication Bypass' tag (which colloquially implies no auth) and the CVSS PR:L metric (which requires the attacker to already hold low privileges) - this should be verified against Oracle's advisory, as it materially changes who can exploit the issue. Oracle CPU disclosures are historically terse and rarely accompanied by technical detail, so treat the exact mechanism as unconfirmed. Overall this warrants prioritized patching given the driver's broad deployment and network attack vector, but the missing exploitability telemetry means it is not confirmed to be under active attack.

An attacker with a foothold as a low-privileged user on the network path to an application that uses Connector/J 9.7.0/9.7.1 abuses the driver's connection/authentication handling to read data it should not be able to access, and - thanks to the scope change - reaches sensitive data belonging to the connected application or other products. Because attack complexity is low and no user interaction is required, exploitation can be scripted once the technique is known. No public exploit code has been identified at time of analysis.