What is the CVSS score of CVE-2026-61093?

CVE-2026-61093 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.4%.

MySQL Server CVE-2026-61093

EUVD-2026-47304 MEDIUM

Uncontrolled Resource Consumption (CWE-400)

2026-07-21 secalert_us@oracle.com

GHSA-c885-7vgw-rp67

Oracle Denial Of Service Mysql Server Mysql Cluster Red Hat

6.5

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

6.5 MEDIUM

PR:L reflects the required low-privilege database account; AV:N and AC:L are appropriate for network-accessible query submission; C:N/I:N because impact is DoS only.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Red Hat

6.5 MEDIUM

qualitative

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 08:24 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

MEDIUM 6.5

DescriptionCVE.org

Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are MySQL Server: 9.7.0-9.7.1; MySQL Cluster: 9.7.0-9.7.1. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 6.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).

AnalysisAI

Denial-of-service in MySQL Server and MySQL Cluster 9.7.0-9.7.1 allows a low-privileged network attacker to repeatedly crash or hang the database server via a flaw in the Optimizer component. Oracle classifies this as 'easily exploitable' with network access required over multiple protocols, meaning any valid database account holder can trigger the condition without elevated permissions. No public exploit code or active exploitation has been identified at time of analysis.

Technical ContextAI

The vulnerability resides in MySQL's Server: Optimizer component - the subsystem responsible for query execution planning, cost estimation, and query rewriting before execution. MySQL Cluster extends this into a distributed, shared-nothing architecture across multiple data nodes, making Optimizer-level crashes potentially more disruptive. Oracle's CVSS vector (AV:N/AC:L/PR:L) indicates exploitation via standard MySQL protocols such as TCP/IP (default port 3306) or the X Protocol. The root cause class (CWE) was not disclosed by Oracle, but availability-only crashes in query optimizers typically stem from null dereferences, divide-by-zero conditions, or infinite loops triggered by specially crafted query constructs. The scope remains unchanged (S:U), indicating the crash is contained within the MySQL process rather than escaping to the host OS.

RemediationAI

Apply Oracle's Critical Patch Update for July 2026, detailed at https://www.oracle.com/security-alerts/cpujul2026.html - the exact patched release version is not independently confirmed in available data and must be verified against that advisory before deployment. As an interim compensating control, restrict network access to MySQL ports (default TCP 3306; X Protocol TCP 33060; Cluster management port TCP 1186) to trusted application subnets using host-based or network firewall rules, reducing the pool of users who can submit queries. Note that overly broad firewall restrictions may disrupt legitimate application connectivity and must be tested. Additionally, audit and minimize database accounts: revoke unnecessary login privileges for service accounts that do not require query execution against the affected Optimizer-heavy workloads. These controls reduce exposure but do not eliminate the vulnerability - patching remains the definitive fix.