MySQL Connector/J CVE-2026-60623

Exploitation requires network reachability to the connector over one of its multiple supported protocols and a low level of existing privilege (PR:L), plus the elevated conditions implied by AC:H - meaning the attacker must control or influence factors outside their direct control (such as being positioned as, or able to impersonate, the MySQL server the client connects to, or winning a race/configuration-dependent condition). No user interaction is required (UI:N). Limiting factors that reduce realistic risk: the high attack complexity, the need for pre-existing low privilege rather than fully anonymous access, and that the exposure centers on the client-side JDBC driver, so environments where Java apps only connect to trusted, TLS-verified database servers are substantially harder to attack. The provided data does not name the exact protocol, feature flag, or configuration setting that gates exploitation, so the specific trigger condition is not confirmed and should be verified against Oracle's advisory.

The signals are mixed and point to a real-but-not-emergency priority. CVSS 3.1 is 7.1 (High), but the vector carries AC:H (difficult to exploit) and PR:L (attacker needs some privilege), which materially lowers practical exploitability despite AV:N and no user interaction. Impact is significant: C:H and I:H mean full read and write of connector-accessible data, though A:L limits availability damage to partial DoS and S:U means no scope change. There is no EPSS score, no SSVC decision, and no CWE in the provided data, so automated-exploitation likelihood cannot be quantified. Not present in CISA KEV and no POC referenced, so no evidence of active or public exploitation. Note a tension worth verifying: the 'Authentication Bypass' tag implies pre-auth abuse, yet the CVSS vector requires PR:L (low privilege) - these are not fully consistent, so confirm the actual privilege prerequisite with Oracle before treating this as unauthenticated. Overall: patch on a normal cycle rather than as an out-of-band emergency, prioritizing Java applications that connect to untrusted or attacker-influenceable MySQL endpoints.

A low-privileged attacker who can influence the database endpoint a Java application connects to - for example by standing up a malicious MySQL server or intercepting the client-to-server path over one of the supported protocols - coerces the vulnerable Connector/J driver into disclosing or altering data the connector can access. Given AC:H, the attacker must satisfy specific timing or configuration conditions to succeed. No public proof-of-concept was identified in the provided intelligence.