Oracle MySQL CVE-2026-60747

The attacker must have local logon access to the operating system or infrastructure layer where MySQL Server or MySQL Cluster is running - this is the defining constraint per CVSS AV:L. No MySQL database credentials are required (PR:N), but OS-level shell, container exec, or equivalent local process execution capability is mandatory. The Replication component must be present and accessible on the target instance; deployments that have entirely disabled replication functionality may have a reduced or absent attack surface, though this is not confirmed from available data. No user interaction is required (UI:N) and no special configuration beyond standard MySQL installation with Replication enabled is implied. Exploitation is limited to: (1) actors with host OS access, (2) affected version ranges only, (3) availability impact only - no data theft or integrity modification is possible via this vector.

The CVSS 3.1 base score of 6.2 (Medium) is consistent with the attack vector: AV:L constrains exploitation to actors with local logon on the database host, substantially limiting the realistic attacker population compared to network-exploitable flaws. AC:L and UI:N indicate no technical barriers beyond that initial access. The impact is purely availability (A:H, C:N, I:N), with no data exfiltration or integrity risk. No EPSS data was provided in the intelligence package; without it, exploitation probability cannot be quantified. No CISA KEV listing exists, and no public exploit or proof-of-concept code has been identified at time of analysis, suggesting this is not being opportunistically weaponized. The most realistic threat actors are malicious insiders, compromised service accounts with OS access, or attackers who have already achieved a foothold on the database host via another vector and seek to cause a service outage. For organizations running MySQL in cloud environments with strict IAM and no direct host shell access, risk is further reduced. SSVC assessment: exploitation status is none/proof-of-concept absent, not automatable over the network, technical impact is partial (availability only) - overall a lower-priority remediation compared to network-exploitable MySQL flaws.

An attacker who has obtained a low-privilege OS shell on the MySQL host - for example, via a compromised application service account or lateral movement from another system - submits a crafted interaction targeting the Replication component without requiring any MySQL database credentials. The Replication subsystem fails to handle the malformed input, causing the MySQL Server or Cluster process to hang or crash repeatedly, resulting in a complete denial of database service until the process is restarted. No public exploit code has been identified, so this scenario currently requires independent vulnerability research to execute.