What is the CVSS score of CVE-2026-61094?

CVE-2026-61094 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Oracle MySQL are affected by CVE-2026-61094?

CVE-2026-61094 affects MySQL Server (versions 8.4.0-8.4.10, 9.7.0-9.7.1) and MySQL Cluster (versions 8.0.0-8.0.47, 8.4.0-8.4.10, 9.7.0-9.7.1), enabling authenticated attackers with high-privilege…. A patch is available.

How to fix or mitigate CVE-2026-61094?

Within 24 hours, identify all MySQL Server and Cluster instances running affected versions (8.4.0-8.4.10, 9.7.0-9.7.1) and apply Oracle's July 2026 Critical Patch Update; simultaneously restrict network access to replication ports and audit high-privileged database accounts. Within 7 days, complete patch deployment across all affected systems, test replication functionality in non-production environments, and validate configuration changes. Within 30 days, conduct security assessment of database access controls, review replication configurations across all clusters, and establish continuous monitoring for suspicious replication activity.

Oracle MySQL CVE-2026-61094

EUVD-2026-47305 HIGH

Improper Privilege Management (CWE-269)

2026-07-21 secalert_us@oracle.com

GHSA-gj2w-2vrw-8hw2

Oracle Privilege Escalation Mysql Server Mysql Cluster Red Hat Suse

7.2

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

7.2 HIGH

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.2 HIGH

Network-reachable replication surface with low complexity but requiring a high-privileged database account (PR:H); no user interaction and full CIA compromise (takeover) without scope change.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

HIGH

qualitative

Red Hat

7.2 HIGH

qualitative

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 00:51 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

HIGH 7.2

DescriptionCVE.org

Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication). Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and 9.7.0-9.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster. Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Takeover of MySQL Server and MySQL Cluster is possible through the Server: Replication component, where a high-privileged attacker with network access can fully compromise affected instances. This authenticated flaw affects MySQL Server 8.4.0-8.4.10 and 9.7.0-9.7.1, and MySQL Cluster 8.0.0-8.0.47, 8.4.0-8.4.10 and 9.7.0-9.7.1, and is fixed in Oracle's July 2026 Critical Patch Update. Oracle rates it CVSS 7.2 with full confidentiality, integrity and availability impact; no public exploit identified at time of analysis.

Technical ContextAI

The vulnerability resides in the Replication subsystem of MySQL Server and MySQL Cluster (NDB) - the mechanism that propagates data changes from a source server to replicas via the binary log and replication threads over standard MySQL client and administrative protocols. Oracle's advisory does not publish a CWE (input lists CWE: N/A) or the specific internal defect, so the exact root-cause class is undisclosed; the 'multiple protocols' language and Server: Replication component indicate the flaw is reachable through the replication/network-facing command surface rather than a local-only interface. The CPE-equivalent affected set spans the MySQL 8.0, 8.4 (LTS) and 9.7 (Innovation) release trains for both the standalone Server and the Cluster distribution.

RemediationAI

Apply the fixes from Oracle's July 2026 Critical Patch Update (https://www.oracle.com/security-alerts/cpujul2026.html) by upgrading to the patched release Oracle designates for each train; the input does not enumerate an exact fixed build number, so confirm the target version (the next maintenance release above 8.0.47 / 8.4.10 / 9.7.1) directly from the CPU matrix rather than assuming one. Because exploitation requires high database privileges, the most effective compensating controls until patching are to tighten privileged access: audit and minimize accounts holding REPLICATION SLAVE/REPLICATION CLIENT and other administrative grants, rotate and vault replication and admin credentials, and enforce that replication ports and admin protocols are reachable only from trusted replica hosts via network ACLs/firewall rules (trade-off: overly strict host allow-lists can break legitimate replica reconnection and must track topology changes). Enable and monitor the audit log for anomalous CHANGE REPLICATION SOURCE or replication-configuration activity as a detective control.