CVE-2026-60315
HighCVSS 8.2Exploitation Probability (EPSS)
Low risk16th percentile - higher than 16% of all known CVEs
Summary
Vulnerability in MySQL Server and MySQL Cluster (component: Server: X Plugin) in multiple versions. It is easy to exploit, requires no authentication and network access. Successful attack can cause hang or frequent crashes (complete denial of service) and unauthorized read access to some data.
Risk Assessment
Risk includes complete unavailability of MySQL Server and MySQL Cluster and partial data leakage, potentially disrupting critical database applications.
Recommendation
Immediately upgrade MySQL Server and MySQL Cluster to versions later than 9.7.1 (for server) and 9.7.1 (for cluster) and restrict network access.
Other vulnerabilities in MySQL Server
See all- CVE-2017-3309High
Vulnerability in the MySQL Server component of Oracle MySQL allows a low privileged attacker with network access to compromise the MySQL Server. Attacks may lead to hanging or frequently repeatable crashes of the server, resulting in a complete denial of service (DoS).
- CVE-2017-3308High
Vulnerability in the MySQL Server component of Oracle MySQL allows a low privileged attacker with network access to compromise MySQL Server. Attacks may lead to hangs or frequent crashes of the server, resulting in complete denial of service.
- CVE-2026-61144Medium
Vulnerability in Oracle MySQL's MySQL Server and MySQL Cluster (component: Server: Optimizer). Affected versions are MySQL Server 9.7.0-9.7.1 and MySQL Cluster 9.7.0-9.7.1. Easily exploitable by a high-privileged attacker with network access via multiple protocols, potentially causing a hang or frequent crash (full DOS) of the server.
- CVE-2026-61128Medium
Vulnerability in MySQL Server and MySQL Cluster (component: Server: Optimizer) allows a high-privileged attacker to cause a hang or frequent crash (DOS) over the network. Network access and multiple protocols are required.
- CVE-2026-61108Medium
MySQL Server and MySQL Cluster versions 9.7.0-9.7.1 have a vulnerability in the GIS component allowing a low-privileged attacker to remotely cause a hang or frequent crash (full DoS).
- CVE-2026-61096Low
Vulnerability in MySQL Server and MySQL Cluster (component: Server: Pluggable Auth) in specified versions. Difficult to exploit, unauthenticated attacker with local logon can modify data.
- CVE-2026-61094High
Vulnerability in MySQL Server and MySQL Cluster (Oracle MySQL) allows a high-privileged attacker with network access via multiple protocols to take over the server. Affects MySQL Server 8.4.0-8.4.10, 9.7.0-9.7.1 and MySQL Cluster 8.0.0-8.0.47, 8.4.0-8.4.10, 9.7.0-9.7.1.
- CVE-2026-60191Medium
MySQL Server (versions 8.4.0-8.4.10, 9.7.0-9.7.1) and MySQL Cluster (versions 8.0.0-8.0.47, 8.4.0-8.4.10, 9.7.0-9.7.1) have a vulnerability in the Server: Replication component. A privileged attacker with local access can cause a hang or frequent crashes (complete DOS).
- CVE-2026-60189Medium
Vulnerability in MySQL Server and MySQL Cluster (component: Server: Replication) allows a high-privileged attacker to cause a hang or frequent crash (DOS). The attack is difficult, requires network access via multiple protocols.
- CVE-2026-60183Medium
Vulnerability in MySQL Server and MySQL Cluster (component: Server: Clone Plugin) affects MySQL Server 8.4.0-8.4.10, 9.7.0-9.7.1 and MySQL Cluster 8.0.0-8.0.47, 8.4.0-8.4.10, 9.7.0-9.7.1. A high-privileged attacker with local access can take over the server or cluster. Exploitation is difficult.
Original NVD description (English source)
Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: X Plugin). Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and 9.7.0-9.7.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster and unauthorized read access to a subset of MySQL Server, MySQL Cluster accessible data. CVSS 3.1 Base Score 8.2 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H).