MySQL Server CVE-2026-60718

The attacker must possess a valid MySQL user account with at least minimal login privileges on the target server - no elevated or administrative rights are required. Network access to the MySQL instance via any supported protocol (classic MySQL protocol port 3306, X Protocol, or others) must be available. The JSON component must be exercised as part of the attack, which is the default state in MySQL 9.7.x since JSON data type support is built-in and not a separately toggleable feature. No additional non-default configuration is required. Exploitation is limited to versions 9.7.0-9.7.1 specifically; deployments on earlier or later versions are not confirmed affected. Publicly accessible MySQL instances without IP-based access controls are at highest risk. Privilege escalation is not possible - the impact is limited to availability.

The CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H scores 6.5 (Medium), but several factors warrant treating this as an elevated operational priority for affected deployments. Attack complexity is Low and no user interaction is required, meaning exploitation is straightforward once an attacker holds any valid MySQL credential. In SaaS, shared hosting, or cloud database environments, low-privileged MySQL accounts are routinely provisioned for application users, expanding the potential attacker pool significantly. The impact is exclusively availability - confidentiality and integrity are unaffected - but a complete, repeatedly reproducible crash of a database server constitutes a severe operational impact for production workloads. No KEV listing or public POC has been identified, and EPSS data is not available in the provided intelligence, so exploitation probability cannot be quantified beyond what the CVSS signals imply. The absence of a CWE classification limits root-cause assessment and makes compensating control design more difficult. Overall: real priority for organizations running MySQL 9.7.0-9.7.1, particularly those with externally accessible MySQL instances or shared credential environments.

An attacker with a low-privileged MySQL account - obtained through credential theft, a default password, or a shared application credential - connects to the target MySQL Server over the standard MySQL protocol and submits a specially crafted JSON query or data payload. The malformed input triggers an unhandled error condition in the JSON processing component, causing the MySQL Server process to hang indefinitely or crash, resulting in a complete denial of service for all connected clients and dependent applications.