CVE-2026-60585 - Vulnerability Details

- mysql: Replication unspecified vulnerability (CPU Jul 2026)

Description

Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication). Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and 9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster. Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 6.6 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H).

Published: 2026-07-21

Score: 6.6 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

Oracle MySQL Server and Cluster contain a flaw in the replication component that can be triggered when a high‑privileged attacker with network access sends specially crafted replication traffic to a vulnerable instance. The flaw stems from insecure privilege handling (CWE‑266) and inadequate access control (CWE‑284), allowing the attacker to bypass authentication and execute arbitrary privileged actions on the database server. Successful exploitation leads to full takeover of the MySQL Server or Cluster, resulting in loss of confidentiality, integrity, and availability of all data on the affected systems.

Affected Systems

Affected products are Oracle MySQL Server and Oracle MySQL Cluster. Vulnerable releases include MySQL Server versions 8.4.0 through 8.4.10 and 9.7.0 through 9.7.1, and MySQL Cluster versions 8.0.0 through 8.0.47, 8.4.0 through 8.4.10, and 9.7.0 through 9.7.1.

Risk and Exploitability

The CVSS v3.1 base score of 6.6 indicates moderate risk, with high confidentiality, integrity, and availability impact. The EPSS score of <1% shows a very low probability of exploitation in the current context, and the vulnerability is not listed in the CISA KEV catalog. However, the requirement for network connectivity and high‑privileged credentials (AC:H, PR:H, AV:N) means that an attacker who can reach the replication interfaces and already possesses administrative access can exploit this weakness to seize the database. Consequently, the attack vector is primarily over the replication protocols exposed on the network.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Oracle Corporation

MySQL Server

affected

Version	Status	Constraints
`8.4.0-8.4.10`	affected	—
`9.7.0-9.7.1`	affected	—

Oracle Corporation

MySQL Cluster

affected

Version	Status	Constraints
`8.0.0-8.0.47`	affected	—
`8.4.0-8.4.10`	affected	—
`9.7.0-9.7.1`	affected	—

Configuration 1 [-]

OR	cpe:2.3:a:oracle:mysql_server::::::::
	cpe:2.3:a:oracle:mysql_server:9.7.0:::::::*
	cpe:2.3:a:oracle:mysql_server:9.7.1:::::::*

Configuration 2 [-]

OR	cpe:2.3:a:oracle:mysql_cluster::::::::
	cpe:2.3:a:oracle:mysql_cluster::::::::
	cpe:2.3:a:oracle:mysql_cluster:9.7.0:::::::*
	cpe:2.3:a:oracle:mysql_cluster:9.7.1:::::::*

No data.

Vendor Product Confidence Versions

Oracle

Mysql Cluster

95%

Version	Status	Scheme	Platform
`[8.0.0,8.0.47]`	affected	semver	—
`[8.4.0,8.4.10]`	affected	semver	—
`[9.7.0,9.7.1]`	affected	semver	—

Oracle

Mysql Server

95%

Version	Status	Scheme	Platform
`[8.4.0,8.4.10]`	affected	semver	—
`[9.7.0,9.7.1]`	affected	semver	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Apply the latest Oracle MySQL CPU Jul 2026 patch to both Server and Cluster to address the privilege escalation and access control issues.
Restart MySQL services to load the updated binaries.
Limit replication traffic by configuring firewalls or VPNs to allow replication interfaces only from trusted hosts.

Generated by OpenCVE AI on August 4, 2026 at 03:28 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

Attack Vector Network

Attack Complexity High

Privileges Required High

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.0035.

Exploitation none

Automatable no

Technical Impact total

References

Link	Providers
https://nvd.nist.gov/vuln/detail/CVE-2026-60585
https://www.cve.org/CVERecord?id=CVE-2026-60585
https://www.oracle.com/security-alerts/cpujul2026.html
https://www.oracle.com/security-alerts/cpujul2026.html#AppendixMSQL

History

Tue, 28 Jul 2026 00:15:00 +0000

Type	Values Removed	Values Added
Title	High Privilege Remote Exploitation of MySQL Server and Cluster via Replication	mysql: Replication unspecified vulnerability (CPU Jul 2026)
Weaknesses		CWE-266
References		https://nvd.nist.gov/vuln/detail/CVE-2026-60585 https://www.cve.org/CVERecord?id=CVE-2026-60585 https://www.oracle.com/security-alerts/cpujul2026.html#AppendixMSQL
Metrics	threat_severity `None`	threat_severity `Moderate`

Mon, 27 Jul 2026 16:30:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Thu, 23 Jul 2026 23:30:00 +0000

Type	Values Removed	Values Added
Title		High Privilege Remote Exploitation of MySQL Server and Cluster via Replication
Weaknesses		CWE-284

Tue, 21 Jul 2026 22:00:00 +0000

Type	Values Removed	Values Added
Description		Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication). Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and 9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster. Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 6.6 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H).
First Time appeared		Oracle Oracle mysql Cluster Oracle mysql Server
CPEs		cpe:2.3:a:oracle:mysql_cluster:::::::: cpe:2.3:a:oracle:mysql_server::::::::
Vendors & Products		Oracle Oracle mysql Cluster Oracle mysql Server
References		https://www.oracle.com/security-alerts/cpujul2026.html
Metrics		cvssV3_1 `{'score': 6.6, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H'}`

Subscriptions

Oracle Mysql Cluster Mysql Server

MITRE

Status: PUBLISHED

Assigner: oracle

Published: 2026-07-21T21:36:00.898Z

Updated: 2026-07-28T03:56:38.972Z

Reserved: 2026-07-08T15:51:40.546Z

Link: CVE-2026-60585

Vulnrichment

Updated: 2026-07-27T15:27:59.823Z

NVD

Status : Analyzed

Published: 2026-07-21T22:17:58.933

Modified: 2026-07-28T17:09:57.577

Link: CVE-2026-60585

Redhat

Severity : Moderate

Publid Date: 2026-07-21T00:00:00Z

Links: CVE-2026-60585 - Bugzilla

OpenCVE Enrichment

Updated: 2026-08-04T03:30:03Z

Weaknesses

CWE-266
Incorrect Privilege Assignment
CWE-284
Improper Access Control

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Network

Attack Complexity High

Privileges Required High

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Exploitation none

Automatable no

Technical Impact total

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object