What is the CVSS score of CVE-2026-61081?

CVE-2026-61081 has a CVSS 3.1 base score of 2.7 (Low). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.2%.

MySQL Server CVE-2026-61081

EUVD-2026-47292 LOW

Information Exposure (CWE-200)

2026-07-21 secalert_us@oracle.com

GHSA-jqr3-jfj2-492m

Oracle Information Disclosure Mysql Server Mysql Cluster

2.7

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

2.7 LOW

AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N

vuln.today AI

2.7 LOW

Network access (AV:N) with high privileges (PR:H) required; only limited confidentiality impact (C:L) with no integrity or availability consequence.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 08:25 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

LOW 2.7

DescriptionCVE.org

Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Performance Schema). Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and 9.7.0-9.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster. Successful attacks of this vulnerability can result in unauthorized read access to a subset of MySQL Server, MySQL Cluster accessible data. CVSS 3.1 Base Score 2.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N).

AnalysisAI

Unauthorized data read in MySQL Server and MySQL Cluster's Performance Schema component exposes a subset of accessible data to highly privileged, network-connected attackers. Affected releases span MySQL Server 8.4.0-8.4.10 and 9.7.0-9.7.1, and MySQL Cluster 8.0.0-8.0.47, 8.4.0-8.4.10, and 9.7.0-9.7.1, disclosed as part of Oracle's July 2026 Critical Patch Update. No public exploit code and no CISA KEV listing are identified at time of analysis; the CVSS 2.7 score reflects the limited scope and elevated privilege bar.

Technical ContextAI

MySQL's Performance Schema (P_S) is an instrumentation layer built into the MySQL server engine that collects runtime execution metadata - query statistics, wait events, memory usage, and lock contention data. Access to P_S tables is governed by MySQL's internal privilege system. The CWE is listed as N/A by the reporter, but the 'Authentication Bypass' tag suggests the flaw may allow an already-authenticated, high-privileged principal to read Performance Schema rows or columns that should be restricted by a secondary internal authorization check - consistent with an intra-component privilege boundary bypass rather than a full authentication bypass. Affected CPE products are MySQL Server (8.4.x, 9.7.x) and MySQL Cluster (8.0.x, 8.4.x, 9.7.x) as distributed by Oracle.

RemediationAI

Apply Oracle's July 2026 Critical Patch Update patches for the affected MySQL Server and MySQL Cluster releases, available via the Oracle advisory at https://www.oracle.com/security-alerts/cpujul2026.html. Specific fixed version numbers are not enumerated in the available data; consult the advisory directly for the exact patch-set release. As a compensating control while patching, restrict network access to MySQL ports (default 3306/TCP and Cluster data node ports) to authorized administrative hosts only via firewall ACLs - this does not eliminate the flaw but reduces the network attack surface. Additionally, audit and minimize the number of accounts holding high-level MySQL privileges, as PR:H is required for exploitation; removing unnecessary administrative grants reduces the pool of exploitable principals. There are no known functional side effects to applying Oracle CPU patches under normal upgrade procedures.