CVE-2026-60311 Oracle Corporation CVE debrief

Who should care

Administrators and users of MySQL Server and MySQL Cluster versions 9.0.0-9.7.1 should be aware of this vulnerability and take necessary actions to mitigate the risk. This includes applying patches or updates provided by Oracle, restricting network access to MySQL Server and MySQL Cluster to only necessary personnel, and monitoring MySQL Server and MySQL Cluster for unusual activity or crashes. Security teams and vulnerability management teams should prioritize patching or mitigating this vulnerability due to its potential impact on data availability.

Technical summary

The vulnerability has a CVSS 3.1 Base Score of 6.5, indicating a medium severity. The CVSS Vector is (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). This vulnerability is classified under CWE-400 and affects the Server: Optimizer component of MySQL Server and MySQL Cluster. A low-privileged attacker with network access via multiple protocols can exploit this vulnerability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server and MySQL Cluster. The vulnerability is considered easily exploitable.

Defensive priority

Medium priority should be given to patching or mitigating this vulnerability, as it can lead to a complete DOS of MySQL Server and MySQL Cluster. Defenders should focus on applying patches or updates provided by Oracle, restricting network access, and monitoring for unusual activity.

Recommended defensive actions

• Apply patches or updates provided by Oracle to fix the vulnerability.
• Restrict network access to MySQL Server and MySQL Cluster to only necessary personnel.
• Monitor MySQL Server and MySQL Cluster for unusual activity or crashes.
• Consider implementing compensating controls, such as intrusion detection and prevention systems.
• Review and update asset inventory to ensure all affected systems are accounted for.
• Plan and schedule remediation through normal change control processes.
• Verify the effectiveness of implemented mitigations and patches.

Evidence notes

The CVE record was published on 2026-07-21T22:17:33.837Z and was last modified on 2026-07-27T17:14:49.970Z. The NVD entry is currently Analyzed. This information is based on the supplied source corpus and may not reflect the current state of the vulnerability. Defenders should verify the accuracy of this information with the official CVE record and NVD entry. The vulnerability affects MySQL Server and MySQL Cluster versions 9.0.0-9.7.1, and a low-privileged attacker with network access via multiple protocols can exploit it to compromise the systems.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.