CVE-2026-60331
MediumCVSS 6.4Exploitation Probability (EPSS)
Low risk3th percentile - higher than 3% of all known CVEs
Summary
Vulnerability in MySQL Server and MySQL Cluster (Server: Replication component) in versions MySQL Server 8.4.0-8.4.10, 9.7.0-9.7.1 and MySQL Cluster 8.0.0-8.0.47, 8.4.0-8.4.10, 9.7.0-9.7.1. A high-privileged attacker with local access can exploit this vulnerability, potentially leading to takeover of MySQL Server and MySQL Cluster.
Risk Assessment
The risk involves potential full compromise of MySQL Server and Cluster, which could lead to breach of confidentiality, integrity, and availability of data and disruption of replication.
Recommendation
Immediately apply patches provided by Oracle for affected versions and restrict local access to servers to trusted high-privileged administrators only.
Other vulnerabilities in MySQL Server, MySQL Cluster
See all- CVE-2026-101750Medium
Vulnerability in MySQL Server and MySQL Cluster (component: Server: Clone Plugin) affects MySQL Server 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1 and MySQL Cluster 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and 26.7.0-26.7.1. A high-privileged authenticated attacker with network access can cause a hang or frequently repeatable crash (complete DoS). CVSS 3.1 Base Score 4.9 (availability impact).
- CVE-2026-101749Medium
Vulnerability in MySQL Server and MySQL Cluster (component: Server: Security: Encryption) affects MySQL Server 26.7.0-26.7.1 and MySQL Cluster 26.7.0-26.7.1. A high-privileged authenticated attacker with network access can cause a hang or frequently repeatable crash (complete DoS). CVSS 3.1 Base Score 4.9 (availability impact).
- CVE-2026-101748Medium
Vulnerability in MySQL Server and MySQL Cluster (component: Server: Security: Audit) affects MySQL Server 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1 and MySQL Cluster 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and 26.7.0-26.7.1. A low-privileged authenticated attacker with network access can cause a hang or frequently repeatable crash (complete DoS). CVSS 3.1 Base Score 6.5 (availability impact).
- CVE-2026-101747Medium
Vulnerability in MySQL Server and MySQL Cluster (component: InnoDB) affects MySQL Server 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1 and MySQL Cluster 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and 26.7.0-26.7.1. A low-privileged authenticated attacker with network access can cause a hang or frequently repeatable crash (complete DoS). CVSS 3.1 Base Score 6.5 (availability impact).
- CVE-2026-101743Medium
Vulnerability in MySQL Server and MySQL Cluster (component: Server: GIS) affects MySQL Server 26.7.0-26.7.1 and MySQL Cluster 26.7.0-26.7.1. A low-privileged authenticated attacker with network access can cause a hang or frequently repeatable crash (complete DoS). CVSS 3.1 Base Score 6.5 (availability impact).
- CVE-2026-101733Medium
Vulnerability in MySQL Server and MySQL Cluster (component: Server: JSON) affects MySQL Server 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1 and MySQL Cluster 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and 26.7.0-26.7.1. A low-privileged authenticated attacker with network access can cause a hang or frequently repeatable crash (complete DoS). CVSS 3.1 Base Score 6.5 (availability impact).
- CVE-2026-61109Medium
Vulnerability in the JSON component of MySQL Server and MySQL Cluster. A low-privileged attacker can remotely cause a hang or frequent crashes (full DOS) of the server.
- CVE-2026-61093Medium
Vulnerability in the Optimizer component of MySQL Server and MySQL Cluster. A low-privileged attacker can remotely cause a hang or frequent crashes (full DOS).
- CVE-2026-60332Medium
Vulnerability in MySQL Server and MySQL Cluster (Server: Group Replication GCS component) in versions MySQL Server 8.4.0-8.4.10, 9.7.0-9.7.1 and MySQL Cluster 8.0.0-8.0.47, 8.4.0-8.4.10, 9.7.0-9.7.1. A high-privileged attacker with local access can exploit this vulnerability, potentially leading to takeover of MySQL Server and MySQL Cluster.
- CVE-2026-60324Medium
Vulnerability in MySQL Server and MySQL Cluster (component: Server: Optimizer) versions 9.7.0-9.7.1. A low-privileged attacker via network can cause a hang or frequent crashes (DOS).
Original NVD description (English source)
Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication). Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and 9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where MySQL Server, MySQL Cluster executes to compromise MySQL Server, MySQL Cluster. Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 6.4 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H).
Vulnerability data from NVD (NIST) · CISA KEV · EPSS