Description
Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/Net). Supported versions that are affected are 9.7.0-9.7.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Connectors. Successful attacks of this vulnerability can result in takeover of MySQL Connectors. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).
Published: 2026-07-21
Score: 8.1 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A flaw in Oracle’s MySQL Connector/Net (versions 9.7.0–9.7.1) permits an unauthenticated attacker with network access to take full control of the connector. The vulnerability is classified as CWE-284 (Improper Access Control) and, if exploited, would allow the attacker to exfiltrate data, modify or delete data, and disrupt service availability, resulting in confidentiality, integrity, and availability impacts.

Affected Systems

Developers and administrators using Oracle MySQL Connector/Net 9.7.0 or 9.7.1 for .NET applications are affected. Any system that hosts or communicates with these connector binaries over the network is at risk.

Risk and Exploitability

The CVSS base score of 8.1 indicates high severity, while an EPSS score less than 1 % reflects a low probability of widespread exploitation at present. The connector is not listed in the CISA KEV catalog. Exploitation requires an unauthenticated network connection to an exposed Connector/Net endpoint, often through multiple protocols, and while the vulnerability is difficult to exploit, the potential impact is substantial. Network isolation, authentication enforcement, and diligent monitoring are recommended to mitigate the threat.

Generated by OpenCVE AI on August 2, 2026 at 23:31 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the latest Oracle update that addresses this vulnerability.
  • Configure the Connector/Net service to require authenticated connections and disable any anonymous or unauthenticated access.
  • Restrict inbound traffic to the Connector/Net port using firewalls or access‑control lists so that only trusted hosts can reach it.
  • Continuously log and monitor connection attempts for anomalous patterns that could indicate exploitation attempts.

Generated by OpenCVE AI on August 2, 2026 at 23:31 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 03 Aug 2026 00:00:00 +0000

Type Values Removed Values Added
Title Difficult to Exploit Remote Service Takeover in Oracle MySQL Connector/Net 9.7.0-9.7.1

Thu, 30 Jul 2026 15:45:00 +0000

Type Values Removed Values Added
Title Unauthenticated Remote Control Vulnerability in Oracle MySQL Connector/Net
Weaknesses CWE-200

Fri, 24 Jul 2026 02:00:00 +0000

Type Values Removed Values Added
Title Unauthenticated Remote Control Vulnerability in Oracle MySQL Connector/Net
Weaknesses CWE-200

Thu, 23 Jul 2026 21:45:00 +0000

Type Values Removed Values Added
Weaknesses CWE-284
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Thu, 23 Jul 2026 04:45:00 +0000

Type Values Removed Values Added
First Time appeared Oracle mysql Connector/net
Vendors & Products Oracle mysql Connector/net

Tue, 21 Jul 2026 21:45:00 +0000

Type Values Removed Values Added
Description Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/Net). Supported versions that are affected are 9.7.0-9.7.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Connectors. Successful attacks of this vulnerability can result in takeover of MySQL Connectors. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).
First Time appeared Oracle
Oracle mysql Connector\/net
CPEs cpe:2.3:a:oracle:mysql_connector\/net:*:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle mysql Connector\/net
References
Metrics cvssV3_1

{'score': 8.1, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Oracle Mysql Connector/net Mysql Connector\/net
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-07-23T17:04:23.105Z

Reserved: 2026-07-08T15:51:40.520Z

Link: CVE-2026-60192

cve-icon Vulnrichment

Updated: 2026-07-23T16:16:09.834Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-02T23:45:03Z

Weaknesses