MySQL Router CVE-2026-60725

Exploitation requires network reachability to the MySQL Router HTTP interface (the 'via HTTP' access path in Oracle's description) on an affected build (8.4.0-8.4.10 or 9.7.0-9.7.1); no authentication is required (PR:N) and no user interaction is needed (UI:N). What limits exploitation is the high attack complexity (AC:H): success depends on conditions outside the attacker's direct control - plausibly that the HTTP/REST management interface is enabled and exposed, and that a specific state or request sequence is met - so deployments that keep the Router HTTP interface bound to loopback or a firewalled management network are not remotely reachable and are effectively out of scope. Oracle did not publish the precise technical precondition, so the exact trigger condition behind AC:H is not confirmed from available data.

The signals are moderately concerning but not urgent. CVSS 3.1 is 7.4 (High) with AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N - network-reachable and unauthenticated, which raises exposure, but AC:H means a meaningful non-trivial precondition or timing/configuration barrier lowers real-world exploitability. Impact is significant: high confidentiality and high integrity to all Router-accessible data, with no availability impact. There is no KEV listing (not confirmed actively exploited), no public exploit identified, and no EPSS score was provided, so probabilistic exploitation likelihood cannot be quantified from the input. A notable tension: the vendor tag 'Authentication Bypass' and PR:N imply no auth is needed, yet AC:H tells defenders that exploitation still involves difficulty - likely specific conditions rather than a trivially scriptable bug. Treat this as a real but second-tier priority: patch on a normal cycle, and prioritize instances whose HTTP interface is network-exposed.

An attacker who can reach a MySQL Router's HTTP management interface over the network sends crafted requests that abuse the authentication/authorization weakness to bypass access controls, then reads and modifies data reachable through the Router. Because AC:H, the attacker likely needs to satisfy a specific condition (e.g., a particular request sequence or configuration state) rather than a single trivial request; no public proof-of-concept has been identified at time of analysis.