CVE-2026-60187
MediumCVSS 4.4Exploitation Probability (EPSS)
Low risk26th percentile - higher than 26% of all known CVEs
Summary
Vulnerability in MySQL Server and MySQL Cluster (component: Server: Replication) in multiple versions. Requires a privileged attacker with network access and is difficult to exploit, but can lead to a complete denial of service (hang or frequent crash).
Risk Assessment
The risk is the potential complete unavailability of the MySQL server or cluster, which can disrupt critical database applications.
Recommendation
Update MySQL Server to version 8.4.11 or later, and MySQL Cluster to version 8.0.48 or later. Restrict network access to replication services.
Other vulnerabilities in MySQL Server, MySQL Cluster
See all- CVE-2026-61109Medium
Vulnerability in the JSON component of MySQL Server and MySQL Cluster. A low-privileged attacker can remotely cause a hang or frequent crashes (full DOS) of the server.
- CVE-2026-61093Medium
Vulnerability in the Optimizer component of MySQL Server and MySQL Cluster. A low-privileged attacker can remotely cause a hang or frequent crashes (full DOS).
- CVE-2026-60332Medium
Vulnerability in MySQL Server and MySQL Cluster (Server: Group Replication GCS component) in versions MySQL Server 8.4.0-8.4.10, 9.7.0-9.7.1 and MySQL Cluster 8.0.0-8.0.47, 8.4.0-8.4.10, 9.7.0-9.7.1. A high-privileged attacker with local access can exploit this vulnerability, potentially leading to takeover of MySQL Server and MySQL Cluster.
- CVE-2026-60331Medium
Vulnerability in MySQL Server and MySQL Cluster (Server: Replication component) in versions MySQL Server 8.4.0-8.4.10, 9.7.0-9.7.1 and MySQL Cluster 8.0.0-8.0.47, 8.4.0-8.4.10, 9.7.0-9.7.1. A high-privileged attacker with local access can exploit this vulnerability, potentially leading to takeover of MySQL Server and MySQL Cluster.
- CVE-2026-60324Medium
Vulnerability in MySQL Server and MySQL Cluster (component: Server: Optimizer) versions 9.7.0-9.7.1. A low-privileged attacker via network can cause a hang or frequent crashes (DOS).
- CVE-2026-60316High
Vulnerability in MySQL Server and MySQL Cluster (X Plugin component) allows a high-privileged attacker via network to take over the system. Exploitation is easy.
- CVE-2026-60195Medium
Vulnerability in the JSON Duality component of MySQL Server and MySQL Cluster. A high-privileged attacker can remotely cause a hang or frequent crashes (full DOS).
- CVE-2026-60194Medium
Vulnerability in the JSON Duality component of MySQL Server and MySQL Cluster. A high-privileged attacker can remotely cause a hang or frequent crashes (full DOS).
- CVE-2026-60190Low
A vulnerability in MySQL Server and MySQL Cluster (component: Server: Replication) allows a high privileged attacker with network access to cause a partial denial of service. Exploitation is difficult.
- CVE-2026-60188Medium
Vulnerability in MySQL Server and MySQL Cluster (component: Server: Replication) in multiple versions. A high-privileged attacker with difficult exploitation can cause a hang or frequent crashes (DOS).
Original NVD description (English source)
Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication). Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and 9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H).