CVE-2026-61081 Oracle Corporation CVE debrief

Who should care

System administrators and security teams responsible for MySQL Server and MySQL Cluster installations, particularly those using affected versions, should be aware of this vulnerability and take necessary precautions to prevent potential exploitation. They should review and update their installations to ensure they are running on supported and patched versions.

Technical summary

The vulnerability is located in the Server: Performance Schema component of MySQL Server and MySQL Cluster. It has a CVSS 3.1 Base Score of 2.7, indicating a low severity. The CVSS Vector is (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N). The vulnerability allows a high-privileged attacker with network access via multiple protocols to compromise MySQL Server and MySQL Cluster, potentially leading to unauthorized read access to a subset of accessible data.

Defensive priority

Apply patches or updates as recommended by the vendor to prevent potential exploitation. Review and update MySQL Server and MySQL Cluster installations to ensure they are running on supported and patched versions.

Recommended defensive actions

• Apply patches or updates as recommended by the vendor
• Review and update MySQL Server and MySQL Cluster installations to ensure they are running on supported and patched versions
• Monitor MySQL Server and MySQL Cluster logs for suspicious activity
• Implement compensating controls, such as network access controls and intrusion detection systems
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed

Evidence notes

The CVE record was published on 2026-07-21T22:18:38.980Z and was last modified on 2026-07-27T17:49:51.677Z. The NVD entry is currently Analyzed. This vulnerability affects MySQL Server versions 8.4.0-8.4.10 and 9.7.0-9.7.1, as well as MySQL Cluster versions 8.0.0-8.0.47, 8.4.0-8.4.10, and 9.7.0-9.7.1. The vulnerability allows a high-privileged attacker with network access via multiple protocols to compromise MySQL Server and MySQL Cluster, potentially leading to unauthorized read access to a subset of accessible data. The CVSS 3.1 Base Score is 2.7, indicating a low severity.

Official resources