What is the CVSS score of CVE-2026-61096?

CVE-2026-61096 has a CVSS 3.1 base score of 2.9 (Low). CVSS vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.1%.

MySQL Server CVE-2026-61096

EUVD-2026-47307 LOW

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-xvhh-x8q7-xrxj

Oracle Authentication Bypass Mysql Server Mysql Cluster

2.9

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

2.9 LOW

AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

vuln.today AI

2.9 LOW

Local vector confirmed by description requiring infrastructure logon; high complexity per undisclosed Pluggable Auth trigger; no confidentiality or availability impact stated.

3.1 AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

4.0 AV:L/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Local

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 08:24 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

LOW 2.9

DescriptionCVE.org

Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Pluggable Auth). Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and 9.7.0-9.7.1. Difficult to exploit vulnerability allows unauthenticated attacker with logon to the infrastructure where MySQL Server, MySQL Cluster executes to compromise MySQL Server, MySQL Cluster. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of MySQL Server, MySQL Cluster accessible data. CVSS 3.1 Base Score 2.9 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N).

AnalysisAI

Local authentication bypass in MySQL Server and MySQL Cluster's Pluggable Auth component allows an unauthenticated local attacker to perform unauthorized data modification under high-complexity conditions. The flaw affects MySQL Server 8.4.0-8.4.10 and 9.7.0-9.7.1, as well as MySQL Cluster across 8.0.0-8.0.47, 8.4.0-8.4.10, and 9.7.0-9.7.1. Impact is limited to low-severity integrity compromise - no confidentiality or availability impact - with no public exploit or CISA KEV listing identified at time of analysis.

Technical ContextAI

The vulnerability resides in Oracle MySQL's Pluggable Authentication framework, a modular authentication subsystem (introduced in MySQL 5.5) that allows server-side and client-side authentication plugins to be loaded dynamically. The Pluggable Auth component handles credential verification when clients connect, meaning a flaw here can undercut the entire authentication boundary regardless of the configured auth plugin. No CWE is assigned by Oracle, but the 'Authentication Bypass' tag and the component involved point to a logic or state-handling flaw in how the pluggable auth subsystem processes or validates credentials under specific conditions. The CVSS vector AV:L indicates exploitation requires local access to the host infrastructure, not a remote network connection. Affected CPEs span MySQL Server 8.4.x and 9.7.x, and MySQL Cluster 8.0.x, 8.4.x, and 9.7.x per the EUVD and NVD data.

RemediationAI

Apply Oracle's July 2026 Critical Patch Update (CPU) available at https://www.oracle.com/security-alerts/cpujul2026.html, which addresses this vulnerability. No specific fixed version number beyond what is implied by the CPU release is independently confirmed from available input data - consult the Oracle CPU advisory directly to identify the exact patched release for your MySQL version line (8.4.x, 9.7.x, or Cluster 8.0.x). As a compensating control, restrict OS-level access to the hosts running MySQL Server or MySQL Cluster to only authorized, trusted users and service accounts, since AV:L means exploitation requires infrastructure logon. Ensure that the principle of least privilege is enforced at the OS level for any accounts co-located with MySQL processes. These access controls directly address the local attack vector and reduce exposure without functional side effects. No workaround that eliminates the Pluggable Auth component itself is practical without disabling authentication functionality.