What is the CVSS score of CVE-2026-60718?

CVE-2026-60718 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.4%.

MySQL Server CVE-2026-60718

EUVD-2026-47065 MEDIUM

Uncontrolled Resource Consumption (CWE-400)

2026-07-21 secalert_us@oracle.com

GHSA-2jvr-rx29-36x8

Denial Of Service Oracle Red Hat Mysql Cluster Mysql Server

6.5

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

6.5 MEDIUM

Network-reachable JSON DoS requiring only a valid MySQL login (PR:L); no confidentiality or integrity impact; complete availability loss via repeatable crash.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Red Hat

6.5 MEDIUM

qualitative

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 08:53 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

MEDIUM 6.5

DescriptionCVE.org

Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: JSON). Supported versions that are affected are MySQL Server: 9.7.0-9.7.1; MySQL Cluster: 9.7.0-9.7.1. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 6.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).

AnalysisAI

Denial-of-service in MySQL Server and MySQL Cluster 9.7.0-9.7.1 allows a low-privileged, network-connected attacker to repeatedly hang or crash the database server by exploiting a flaw in the JSON component. The vulnerability requires only a valid MySQL login and network access over any supported protocol, making it trivially reachable in multi-tenant or cloud-hosted environments. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and low privilege threshold elevate practical risk above what the moderate CVSS score of 6.5 might suggest.

Technical ContextAI

The vulnerability resides in the JSON processing subsystem of Oracle MySQL Server and MySQL Cluster, versions 9.7.0 through 9.7.1. MySQL's JSON component handles native JSON data type storage, parsing, and function evaluation (e.g., JSON_EXTRACT, JSON_TABLE, JSON_OBJECT). A flaw in this component - CWE classification was not provided in available data - allows a crafted input to trigger an unhandled condition resulting in a server hang or crash. The vulnerability is accessible via multiple MySQL protocols, including the classic MySQL protocol (port 3306) and X Protocol, confirming network reachability without requiring physical or local system access. Both the standalone MySQL Server and the distributed MySQL Cluster deployments share the same affected code path in versions 9.7.0-9.7.1.

RemediationAI

Apply the patch issued by Oracle as part of the Critical Patch Update for July 2026, available via https://www.oracle.com/security-alerts/cpujul2026.html. An exact fixed release version number is not independently confirmed in the available intelligence beyond the CPU advisory itself - consult the Oracle advisory directly for the specific patched build. As an interim compensating control, restrict MySQL network access using firewall rules or security group policies to permit connections only from trusted application hosts, reducing exposure to low-privileged but network-reachable attackers. Additionally, auditing and minimizing the number of active low-privileged MySQL user accounts reduces the attacker surface while the patch is applied. Disabling the JSON component is not a practical workaround for most deployments. Note that network restriction does not eliminate risk if shared or multi-tenant application accounts are already present.