CVE-2026-60177 Oracle Corporation CVE debrief

Who should care

Administrators and users of MySQL Server and MySQL Cluster products, especially those with high-privileged access, should be aware of this vulnerability and take necessary actions to mitigate the risk. This includes reviewing and applying patches, restricting network access, and monitoring for unusual activity.

Technical summary

The vulnerability has a CVSS 3.1 Base Score of 4.4 (Availability impacts) and a CVSS Vector of (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H). The vulnerability is classified under CWE-400. It is a difficult-to-exploit vulnerability that allows high-privileged attackers with network access via multiple protocols to compromise MySQL Server and MySQL Cluster, potentially leading to a complete DOS of these systems.

Defensive priority

Medium priority should be given to patching and mitigating this vulnerability, as it can lead to a complete DOS of MySQL Server and MySQL Cluster.

Recommended defensive actions

• Apply patches and updates provided by Oracle to fix the vulnerability.
• Restrict network access to MySQL Server and MySQL Cluster to only necessary personnel.
• Monitor MySQL Server and MySQL Cluster for unusual activity and crashes.
• Consider implementing compensating controls, such as Web Application Firewalls (WAFs), to detect and prevent attacks.
• Review and update asset inventory to identify potentially affected systems.
• Perform exposure review to determine potential impact on the organization.
• Track and monitor changes to the environment for potential security risks.

Evidence notes

The CVE record was published on 2026-07-21T22:17:18.617Z and was last modified on 2026-07-27T14:49:41.157Z. The NVD entry is currently Analyzed. This information is based on the NVD entry and the CVE record. Defenders should verify the affected versions of MySQL Server and MySQL Cluster and review the official advisory for specific guidance.

Official resources