What is the CVSS score of EUVD-2026-46593?

EUVD-2026-46593 has a CVSS 3.1 base score of 4.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.3%.

Is there a patch available for EUVD-2026-46593?

Yes, a patch is available for EUVD-2026-46593. Update the affected software to the latest version immediately.

MySQL Server EUVD-2026-46593

| CVE-2026-60187 MEDIUM

Uncontrolled Resource Consumption (CWE-400)

2026-07-21 oracle

GHSA-pcvf-6mq8-j65f

Denial Of Service Oracle Red Hat Mysql Cluster Mysql Server Suse Oracle Corporation

4.4

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

4.4 MEDIUM

AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

4.4 MEDIUM

Network vector confirmed by multi-protocol access; AC:H and PR:H reflect replication-context conditions and required admin credentials; only availability impacted with no data exposure.

3.1 AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:H/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

SUSE

MEDIUM

qualitative

Red Hat

4.4 MEDIUM

qualitative

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

High

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 02:16 vuln.today

CVE Published

Jul 21, 2026 - 21:33 nvd

MEDIUM 4.4

DescriptionCVE.org

Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication). Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and 9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H).

AnalysisAI

Denial-of-service exposure in the MySQL Server and MySQL Cluster Replication component allows a high-privileged, network-connected attacker to crash or hang the database instance repeatedly. Affected releases span MySQL Server 8.4.0-8.4.10 and 9.7.0-9.7.1, and MySQL Cluster 8.0.0-8.0.47, 8.4.0-8.4.10, and 9.7.0-9.7.1, as confirmed by Oracle's July 2026 Critical Patch Update and ENISA EUVD-2026-46593. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog; however, its presence in a broadly deployed database product warrants patch prioritization within normal maintenance cycles for affected installations.

Technical ContextAI

MySQL's Replication component manages binary log-based data synchronization between primary and replica instances over multiple protocols including standard TCP/IP MySQL protocol and replication-specific channels. The CPE strings cpe:2.3:a:oracle_corporation:mysql_server and cpe:2.3:a:oracle_corporation:mysql_cluster confirm both the server and cluster product lines are within scope across multiple version branches (8.0.x, 8.4.x, 9.7.x). No CWE identifier is assigned in available intelligence, precluding formal root-cause class categorization from public data alone; Oracle's description classifies this only as a Denial of Service flaw within the replication subsystem. The multi-protocol attack surface (AV:N) suggests the flaw may be triggerable through standard MySQL client connections or via dedicated replication channel traffic. The CVSS High Attack Complexity (AC:H) metric implies the attacker must satisfy non-standard preconditions - such as a specific server state, race condition, or replication topology requirement - beyond simply having credentials.

RemediationAI

The primary remediation is to apply the patches released as part of Oracle's Critical Patch Update for July 2026, available at https://www.oracle.com/security-alerts/cpujul2026.html. Exact fixed version numbers are not independently stated in the available intelligence and must be confirmed directly from that advisory before deployment. As a compensating control prior to patching, organizations should restrict network-level access to MySQL replication ports (default 3306, or custom replication ports) to only trusted replica host IP addresses using firewall rules or MySQL's bind-address configuration - this directly raises the bar for the AV:N attack path without disabling functionality. Additionally, auditing and minimizing the set of accounts granted REPLICATION SLAVE, REPLICATION CLIENT, and SUPER privileges reduces the effective pool of accounts meeting the PR:H prerequisite; removing unused replication accounts is zero-impact and immediately effective. Disabling replication entirely would eliminate this specific attack surface but would disrupt high-availability and disaster recovery architectures and carries significant operational trade-offs. Patch application during a scheduled maintenance window is the preferred resolution.