What is the CVSS score of CVE-2026-60747?

CVE-2026-60747 has a CVSS 3.1 base score of 6.2 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.1%.

Is there a patch available for CVE-2026-60747?

Yes, a patch is available for CVE-2026-60747. Update the affected software to the latest version immediately.

Oracle MySQL CVE-2026-60747

EUVD-2026-47079 MEDIUM

Uncontrolled Resource Consumption (CWE-400)

2026-07-21 secalert_us@oracle.com

GHSA-4xr7-8qqf-4gj7

Oracle Denial Of Service Mysql Server Mysql Cluster Red Hat Suse

6.2

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

6.2 MEDIUM

AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

6.2 MEDIUM

AV:L confirmed by description requiring host-level logon; PR:N because no database or OS privileges needed beyond that logon; A:H for complete service crash; no confidentiality or integrity impact.

3.1 AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

SUSE

MEDIUM

qualitative

Red Hat

6.2 MEDIUM

qualitative

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 08:52 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

MEDIUM 6.2

DescriptionCVE.org

Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication). Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and 9.7.0-9.7.1. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where MySQL Server, MySQL Cluster executes to compromise MySQL Server, MySQL Cluster. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 6.2 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).

AnalysisAI

Local denial-of-service in Oracle MySQL Server and MySQL Cluster allows an unauthenticated attacker with OS-level logon access to the host infrastructure to crash or hang the database service via a flaw in the Replication component. Affected versions span MySQL Server 8.4.0-8.4.10 and 9.7.0-9.7.1, and MySQL Cluster 8.0.0-8.0.47, 8.4.0-8.4.10, and 9.7.0-9.7.1. Oracle classifies this as easily exploitable; no public exploit code or CISA KEV listing has been identified at time of analysis, and exploitation requires physical or logical host-level access rather than remote network reachability.

Technical ContextAI

The vulnerability resides in the Replication component of Oracle MySQL Server and MySQL Cluster - the subsystem responsible for binary log shipping, replica I/O and SQL threads, and replication topology management. The CVSS vector AV:L confirms the attack surface is local to the infrastructure (e.g., OS shell, container, or VM co-tenancy), not the MySQL network port, meaning the triggering input is delivered at the process or filesystem level rather than over the database wire protocol. The combination of PR:N and AV:L indicates that any OS-level principal with logon access - even an unprivileged local user - can interact with the replication subsystem in a way that produces an unhandled condition leading to a hang or repeated crash. No CWE was assigned by Oracle, so the precise root cause class (e.g., null pointer dereference, assertion failure, resource exhaustion) is unconfirmed from available data. CPE data covers Oracle MySQL Server and MySQL Cluster across the enumerated version ranges.

RemediationAI

Apply the patches published in the Oracle Critical Patch Update for July 2026, available at https://www.oracle.com/security-alerts/cpujul2026.html. Specific patched version numbers are not enumerated in the available intelligence; consult the Oracle advisory's risk matrix for the exact fix versions applicable to your MySQL Server or MySQL Cluster release stream. As a compensating control while patching is scheduled, restrict OS-level logon access to database hosts to only authorized database administrators - remove shell access for application service accounts and enforce least-privilege principles on the host OS. If MySQL replication is not in use, consider disabling or restricting the replication thread configuration to reduce attack surface, though side effects on HA and DR topologies must be evaluated before making that change. Container and cloud deployments should audit IAM roles and ensure no unprivileged identities have exec access to the MySQL container or VM.