What is the CVSS score of EUVD-2026-46577?

EUVD-2026-46577 has a CVSS 3.1 base score of 4.9 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.4%.

MySQL Cluster EUVD-2026-46577

| CVE-2026-60171 MEDIUM

Uncontrolled Resource Consumption (CWE-400)

2026-07-21 oracle

GHSA-7cxr-6j58-68m6

Denial Of Service Oracle Mysql Cluster Oracle Corporation

4.9

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

4.9 MEDIUM

AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

4.9 MEDIUM

Network vector and high privilege confirmed by Oracle; availability-only impact aligns with DoS-only description; no confidentiality or integrity impact applies.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 02:20 vuln.today

DescriptionCVE.org

Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.0-8.0.47. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Cluster. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).

AnalysisAI

Oracle MySQL Cluster's Server: Optimizer component in versions 8.0.0 through 8.0.47 can be exploited by a high-privileged remote attacker to cause a complete denial of service via repeated hang or crash of the cluster. Oracle disclosed and patched this in the July 2026 Critical Patch Update (CPU). No public exploit code or active exploitation has been identified at time of analysis, and CISA KEV listing is absent.

Technical ContextAI

MySQL Cluster is Oracle's distributed, high-availability database solution built on the NDB storage engine, designed for real-time, carrier-grade workloads. The vulnerable component is the Server: Optimizer - the query optimization and execution planning subsystem responsible for determining efficient query execution plans. Oracle has not assigned a CWE identifier, so the precise root cause class (e.g., NULL pointer dereference, infinite loop, integer overflow in plan computation) cannot be confirmed from available data. Affected products are identified by CPE cpe:2.3:a:oracle_corporation:mysql_cluster:*:*:*:*:*:*:*:*, covering the full 8.0.x branch through 8.0.47. The vulnerability is reachable via multiple protocols supported by MySQL Cluster, consistent with the network attack vector.

RemediationAI

Administrators should apply Oracle's July 2026 Critical Patch Update, available at https://www.oracle.com/security-alerts/cpujul2026.html, which addresses this vulnerability by upgrading beyond MySQL Cluster 8.0.47. The exact fixed version number is not independently confirmed in the provided data beyond the implication that 8.0.48 or a subsequent release contains the fix - verify the specific patched version in Oracle's CPU documentation. If immediate patching is not feasible, compensating controls include using host-based and network firewalls to restrict access to MySQL Cluster data node and management node endpoints to only trusted, authorized hosts, reducing the network attack surface despite the AV:N vector. Additionally, enforcing strict least-privilege account controls and multi-factor authentication for high-privileged database accounts directly addresses the PR:H exploitation prerequisite - without compromised high-privilege credentials, exploitation is not possible. Monitor cluster logs for anomalous query patterns or unexpected restarts as a detection measure.