What is the CVSS score of CVE-2026-60623?

CVE-2026-60623 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L. EPSS exploitation probability: 0.2%.

Which versions of MySQL Connector/J are affected by CVE-2026-60623?

Oracle MySQL Connector/J versions 9.7.0 through 9.7.1 contain a data compromise vulnerability that allows low-privileged attackers with network access to read, create, modify, or delete database…

How to fix or mitigate CVE-2026-60623?

Within 24 hours, inventory all systems and applications using Oracle MySQL Connector/J to identify those running versions 9.7.0 or 9.7.1. Within 7 days, assess the exposure of each affected connector-specifically, whether they have network accessibility from untrusted networks and the sensitivity of data they access-then implement interim compensating controls for high-risk instances. Within 30 days, apply the vendor patch when Oracle releases the July 2026 Critical Patch Update, or upgrade to a patched version if available sooner.

MySQL Connector/J CVE-2026-60623

EUVD-2026-46981 HIGH

Missing Authentication for Critical Function (CWE-306)

2026-07-21 secalert_us@oracle.com

GHSA-86j7-wrcm-v3wc

Authentication Bypass Denial Of Service Oracle Mysql Connectors

7.1

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

7.1 HIGH

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L

vuln.today AI

7.1 HIGH

Concur with Oracle: network-reachable but high-complexity (AC:H) and requires low privilege (PR:L); full read/write of connector data (C:H/I:H) with only partial DoS (A:L) and no scope change.

3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L

4.0 AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 07:20 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

HIGH 7.1

DescriptionCVE.org

Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/J). Supported versions that are affected are 9.7.0-9.7.1. Difficult to exploit vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Connectors. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all MySQL Connectors accessible data as well as unauthorized access to critical data or complete access to all MySQL Connectors accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of MySQL Connectors. CVSS 3.1 Base Score 7.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L).

AnalysisAI

Data compromise in Oracle MySQL Connector/J (MySQL Connectors 9.7.0 through 9.7.1) allows a low-privileged attacker with network access over multiple protocols to read, create, delete, or modify all data accessible to the connector and to cause a partial denial of service. Oracle rates this CVSS 3.1 7.1 (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L), reflecting high difficulty of exploitation but broad confidentiality and integrity impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; the fix ships in Oracle's July 2026 Critical Patch Update.

Technical ContextAI

Connector/J is Oracle's official JDBC driver that Java applications use to connect to MySQL databases, handling the client-server wire protocol, TLS negotiation, statement execution and result parsing. Because the flaw lives in the connector (client-side driver) rather than the MySQL server, the exposure is typically realized on the path between a Java application and the database endpoint it talks to - a class of issue where a malicious or man-in-the-middle server, or manipulation of the multiple protocols the driver supports, can subvert the client. Oracle does not assign a CWE for this entry (CWE: N/A), so the precise root-cause weakness class is not disclosed; the tag 'Authentication Bypass' hints the defect may relate to authentication or trust handling in the connection flow, but this is not confirmed by a CWE mapping.

RemediationAI

Upgrade Connector/J to the fixed release documented in Oracle's July 2026 Critical Patch Update (https://www.oracle.com/security-alerts/cpujul2026.html); the exact fixed version number is not stated in the provided data, so confirm the target build directly from that advisory before deploying - do not assume a version. As compensating controls until patched, enforce TLS with full server certificate and hostname verification on all JDBC connection strings (set sslMode=VERIFY_IDENTITY) so a rogue or man-in-the-middle server cannot be substituted, restrict which database hosts application servers may reach at the network layer, and avoid connecting Connector/J to untrusted or attacker-controllable MySQL endpoints. The trade-off of strict TLS verification is that misconfigured or self-signed database certificates will cause connection failures and must be corrected first. These are mitigations, not fixes: applying the Oracle CPU update remains the primary remediation.