What is the CVSS score of CVE-2026-60725?

CVE-2026-60725 has a CVSS 3.1 base score of 7.4 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.3%.

Which versions of MySQL Router are affected by CVE-2026-60725?

Oracle MySQL Router versions 8.4.0-8.4.10 and 9.7.0-9.7.1 contain an authentication-bypass vulnerability enabling unauthenticated network attackers to gain direct read and write access to all data…

How to fix or mitigate CVE-2026-60725?

Within 24 hours, identify all systems running Oracle MySQL Router 8.4.0-8.4.10 or 9.7.0-9.7.1, assess network exposure of each instance, and document which systems handle sensitive data. Over the next 7 days, implement firewall rules and IP whitelisting to restrict HTTP access to affected Router instances to trusted internal sources only, enable comprehensive logging on all Router database connections, and establish monitoring and alerting for suspicious query patterns or unauthorized connection attempts. Within 30 days, test and plan an upgrade to unaffected versions (8.3.x or earlier for the 8.x line, 9.6.x or earlier for the 9.x line), publish a phased rollout timeline to business stakeholders, and establish a process to subscribe to Oracle security advisories for future patch notifications.

MySQL Router CVE-2026-60725

EUVD-2026-47069 HIGH

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-4rrq-wr4q-fg4w

Authentication Bypass Oracle Mysql Router

7.4

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

7.4 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

vuln.today AI

7.4 HIGH

Network-reachable unauthenticated HTTP interface (AV:N/PR:N/UI:N) but a non-trivial precondition drives AC:H; high read/write data impact (C:H/I:H) with no availability effect (A:N).

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 03:27 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

HIGH 7.4

DescriptionCVE.org

Vulnerability in the MySQL Router product of Oracle MySQL (component: Router: General). Supported versions that are affected are 8.4.0-8.4.10 and 9.7.0-9.7.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise MySQL Router. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all MySQL Router accessible data as well as unauthorized access to critical data or complete access to all MySQL Router accessible data. CVSS 3.1 Base Score 7.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N).

AnalysisAI

Data compromise in Oracle MySQL Router 8.4.0-8.4.10 and 9.7.0-9.7.1 allows a network attacker to gain unauthorized read and write access to all data reachable through the Router component. The flaw is reachable unauthenticated over HTTP (PR:N) but is rated hard to exploit (AC:H), and there is no public exploit identified at time of analysis. Oracle's tagging references an authentication-bypass class of issue, consistent with the unauthenticated network vector.

Technical ContextAI

MySQL Router is the lightweight connection-routing and load-balancing middleware in Oracle's MySQL InnoDB Cluster / ReplicaSet stack; it sits between application clients and backend MySQL servers and exposes an HTTP-based management/REST interface (used for its REST API and metrics/health endpoints). The vulnerability is in the 'Router: General' component and is reached 'via HTTP', which points at this embedded HTTP interface rather than the MySQL wire protocol. Oracle did not assign a CWE (CWE: N/A), but the vendor tag 'Authentication Bypass' suggests the root cause is a broken or missing authentication/authorization check on that HTTP surface, allowing an unauthenticated caller to reach protected functionality that governs data flowing through the Router.

RemediationAI

Apply the fixes delivered in the Oracle Critical Patch Update of July 2026 (https://www.oracle.com/security-alerts/cpujul2026.html) - Patch available per vendor advisory; an exact fixed build number is not stated in the provided data, so consult the CPU matrix for the precise patched release above 8.4.10 and 9.7.1 for your branch. Until patched, reduce exposure of the Router's HTTP/REST management interface: bind it to localhost or a trusted management network and firewall the REST/HTTP port so it is not reachable from application or untrusted networks (trade-off: remote monitoring/automation against that endpoint breaks and must be re-homed to the trusted segment). If the HTTP REST interface is not required, disable it in the Router configuration to remove the attack surface entirely (trade-off: loss of REST-based status/metrics integration). Do not rely solely on network controls as a permanent fix - schedule the vendor patch.