PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-61128 Oracle Corporation CVE debrief

A vulnerability was discovered in the MySQL Server and MySQL Cluster products of Oracle MySQL, specifically in the Server: Optimizer component. The affected versions are MySQL Server: 9.7.0-9.7.1 and MySQL Cluster: 9.7.0-9.7.1. This vulnerability allows a high-privileged attacker with network access via multiple protocols to compromise MySQL Server and MySQL Cluster, potentially leading to a hang or frequently repeatable crash (complete DOS) of the affected systems. The vulnerability has a medium severity level based on its CVSS score.

Vendor
Oracle Corporation
Product
MySQL Server
CVSS
MEDIUM 4.9
CISA KEV
Not listed in stored evidence
Original CVE published
2026-07-21
Original CVE updated
2026-07-27
Advisory published
2026-07-21
Advisory updated
2026-07-27

Who should care

System administrators and security teams responsible for MySQL Server and MySQL Cluster installations, particularly those using versions 9.7.0-9.7.1, should be aware of this vulnerability and take necessary actions to mitigate the risk. This includes reviewing system configurations, monitoring for suspicious activity, and applying patches or updates as provided by Oracle.

Technical summary

The vulnerability has a CVSS 3.1 Base Score of 4.9, indicating a medium severity level. The CVSS Vector is (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H), showing that the vulnerability allows for high privileged attacks with network access, leading to availability impacts. The CWE associated with this vulnerability is CWE-400. This vulnerability affects MySQL Server versions 9.7.0-9.7.1 and MySQL Cluster versions 9.7.0-9.7.1, specifically in the Server: Optimizer component.

Defensive priority

Medium priority should be given to patching or mitigating this vulnerability, as it can lead to a denial of service (DOS) attack. However, given the high privileges required for exploitation, the immediate risk may be limited. Nonetheless, it is crucial to address this vulnerability in a timely manner to prevent potential disruptions.

Recommended defensive actions

  • Apply the patches or updates provided by Oracle to fix the vulnerability.
  • Restrict network access to MySQL Server and MySQL Cluster to only necessary personnel.
  • Monitor MySQL Server and MySQL Cluster installations for any suspicious activity.
  • Consider implementing compensating controls, such as web application firewalls or intrusion detection systems.
  • Review and update asset inventories to ensure all affected systems are accounted for.
  • Perform regular security audits to identify potential vulnerabilities.
  • Establish a process for tracking and addressing exceptions in remediation efforts.

Evidence notes

The CVE record was published on 2026-07-21T22:18:44.050Z and was last modified on 2026-07-27T17:41:00.117Z. The NVD entry is currently Analyzed. This information is based on the provided source corpus and may not reflect the full scope of affected systems or potential impacts. Defenders should verify the accuracy of this information within their specific environments.

Official resources

AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-07-21T22:18:44.050Z and has not been modified since then. The NVD entry is currently Analyzed.