PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-60171 Oracle Corporation CVE debrief

A vulnerability exists in MySQL Cluster, an Oracle MySQL component, specifically in the Server: Optimizer. The affected versions are 8.0.0 through 8.0.47. This issue allows a high-privileged attacker with network access to cause a denial of service (complete DOS) of MySQL Cluster. The vulnerability has a CVSS 3.1 Base Score of 4.9, indicating a medium severity. The CVSS Vector is CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H. System administrators and security teams should prioritize patching to prevent potential denial-of-service attacks.

Vendor
Oracle Corporation
Product
MySQL Cluster
CVSS
MEDIUM 4.9
CISA KEV
Not listed in stored evidence
Original CVE published
2026-07-21
Original CVE updated
2026-07-27
Advisory published
2026-07-21
Advisory updated
2026-07-27

Who should care

System administrators and security teams managing MySQL Cluster installations, especially those using versions 8.0.0 through 8.0.47, should prioritize patching this vulnerability to prevent potential denial-of-service attacks. IT operations teams and cybersecurity professionals responsible for maintaining and securing MySQL Cluster environments should also be aware of this vulnerability and take necessary actions.

Technical summary

The vulnerability, CVE-2026-60171, is in the Server: Optimizer component of MySQL Cluster. It allows a high-privileged attacker with network access via multiple protocols to compromise MySQL Cluster, leading to unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Cluster. The CVSS 3.1 Base Score is 4.9, indicating a medium severity. The CVSS Vector is CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H. The vulnerability is easily exploitable and affects versions 8.0.0 through 8.0.47 of MySQL Cluster.

Defensive priority

Medium priority should be given to patching this vulnerability, especially in environments where high-privileged access is a concern or where the MySQL Cluster is exposed to the network. Additional defensive measures, such as monitoring and compensating controls, should also be considered.

Recommended defensive actions

  • Inventory and assess MySQL Cluster installations for version 8.0.0 through 8.0.47
  • Apply the security patch from Oracle as soon as possible
  • Implement compensating controls such as network segmentation or access controls to limit exposure
  • Monitor MySQL Cluster logs for unusual activity or crashes
  • Consider enhancing monitoring and exception tracking for high-privileged access
  • Review and update incident response plans to include denial-of-service attack scenarios
  • Conduct a thorough risk assessment to identify and prioritize assets that require immediate patching

Evidence notes

The CVE record was published on 2026-07-21T22:17:17.933Z and was last modified on 2026-07-27T14:50:29.640Z. The NVD entry is currently Analyzed. Vendor advisory is available from Oracle. Evidence is limited to public sources and may not reflect the full scope or impact of the vulnerability. Defenders should verify affected systems and apply patches or mitigations as recommended by the vendor.

Official resources

AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-07-21T22:17:17.933Z and has not been modified since then. The NVD entry is currently Analyzed.