CVE-2026-60163
HighCVSS 8.4Exploitation Probability (EPSS)
Low risk7th percentile - higher than 7% of all known CVEs
Summary
Vulnerability in MySQL Server and MySQL Cluster (component: Server: Group Replication Plugin) allows an unauthenticated attacker with local access to take over the system. Affects multiple versions of MySQL Server and MySQL Cluster.
Risk Assessment
Attack can lead to full takeover of MySQL Server or MySQL Cluster, compromising confidentiality, integrity, and availability of data.
Recommendation
Apply patches from Oracle for affected versions of MySQL Server (8.4.0-8.4.10, 9.7.0-9.7.1) and MySQL Cluster (8.0.0-8.0.47, 8.4.0-8.4.10, 9.7.0-9.7.1). Restrict local access to database servers.
Other vulnerabilities in MySQL
See all- CVE-2000-0148High
MySQL 3.22 allows remote attackers to bypass password authentication and access a database via a short check string.
- CVE-2000-0045Medium
MySQL allows local users to modify passwords for arbitrary MySQL users via the GRANT privilege.
- CVE-2026-61081Low
A vulnerability in MySQL Server and MySQL Cluster (Performance Schema component) allows an authenticated attacker with high privileges to unauthorizedly read a subset of data. The attack requires network access and is easy to exploit.
- CVE-2026-60747Medium
Vulnerability in MySQL Server and MySQL Cluster (component: Server: Replication) in multiple versions. An unauthenticated attacker with local access can cause a complete denial of service (DOS).
- CVE-2026-60718Medium
Vulnerability in MySQL Server and MySQL Cluster (component: Server: JSON). Affected versions: MySQL Server 9.7.0-9.7.1, MySQL Cluster 9.7.0-9.7.1. Easily exploitable by a low-privileged attacker with network access via multiple protocols. Successful attack can cause a hang or frequent crash (complete DoS) of MySQL Server or Cluster. CVSS 3.1 Base Score 6.5 (Availability impacts).
- CVE-2026-60585Medium
Vulnerability in MySQL Server and MySQL Cluster Replication component. A high-privileged attacker via multiple protocols can take over the system.
- CVE-2026-60311Medium
Vulnerability in MySQL Server and MySQL Cluster (Server: Optimizer). A low-privileged attacker can cause a complete denial of service.
- CVE-2026-47064Medium
Vulnerability in MySQL Server and MySQL Cluster (component: Server: Optimizer) in multiple versions. Easily exploitable flaw allows a low-privileged attacker with network access via multiple protocols to cause a hang or frequent repeatable crash (complete DOS) of MySQL Server or Cluster.
- CVE-1999-1188Medium
mysqld in MySQL 3.21 creates log files with world-readable permissions, allowing local users to obtain passwords for users in the user database.
Original NVD description (English source)
Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Group Replication Plugin). Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and 9.7.0-9.7.1. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where MySQL Server, MySQL Cluster executes to compromise MySQL Server, MySQL Cluster. Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 8.4 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).