Description
Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/J). Supported versions that are affected are 9.7.0-9.7.1. Difficult to exploit vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Connectors. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all MySQL Connectors accessible data as well as unauthorized access to critical data or complete access to all MySQL Connectors accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of MySQL Connectors. CVSS 3.1 Base Score 7.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L).
Published: 2026-07-21
Score: 7.1 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability resides in Oracle MySQL Connector/J versions 9.7.0 and 9.7.1 and allows an attacker with low privileges but network access to create, delete, or modify data and to gain unauthorized read access to all data exposed by the connector. This can result in loss of confidentiality, integrity, and a partial denial of service. The weakness is a missing authentication check for a sensitive operation, classified as CWE‑306.

Affected Systems

Oracle MySQL Connector/J (Oracle Corporation) versions 9.7.0 and 9.7.1 on any platform that accepts network connections are vulnerable. All deployments of these releases that expose the Connector/J over the network are at risk, whereas later releases are presumed safe.

Risk and Exploitability

The CVSS v3.1 base score of 7.1 indicates high severity with substantial confidentiality, integrity, and availability impacts. The EPSS score below 1% suggests a low but nonzero likelihood of exploitation. The vulnerability is not listed in CISA KEV, indicating no widespread exploitation has been reported. An attacker would likely use a network-based exploit, sending crafted requests to the Connector/J over supported protocols, leveraging the low‑privilege authentication bypass to perform unauthorized operations or induce partial downtime.

Generated by OpenCVE AI on August 4, 2026 at 17:00 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the latest vendor‑published fix or upgrade to a later stable release of MySQL Connector/J that addresses this issue.
  • If an immediate upgrade is not possible, restrict inbound network traffic to Connector/J instances and enforce strong authentication to limit low‑privileged access.
  • Implement application‑level access controls to ensure that any operation performed via the connector is executed only for the authorized user, and monitor logs for anomalous write or denial‑of‑service activity.

Generated by OpenCVE AI on August 4, 2026 at 17:00 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 04 Aug 2026 17:30:00 +0000

Type Values Removed Values Added
Title Unauthorized Data Manipulation via Low-Privilege Access in MySQL Connector/J

Sat, 01 Aug 2026 05:45:00 +0000

Type Values Removed Values Added
Title Unauthorized Data Manipulation via Low-Privilege Access in MySQL Connector/J

Wed, 29 Jul 2026 19:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-306
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Mon, 27 Jul 2026 12:45:00 +0000

Type Values Removed Values Added
Title Low Privileged Network Attack Enables Data Manipulation and Partial Denial of Service in MySQL Connector/J
Weaknesses CWE-284
CWE-285

Thu, 23 Jul 2026 23:15:00 +0000

Type Values Removed Values Added
Title Low Privileged Network Attack Enables Data Manipulation and Partial Denial of Service in MySQL Connector/J
Weaknesses CWE-284
CWE-285

Thu, 23 Jul 2026 10:15:00 +0000

Type Values Removed Values Added
First Time appeared Oracle mysql Connector/j
Oracle mysql Connectors
Vendors & Products Oracle mysql Connector/j
Oracle mysql Connectors

Tue, 21 Jul 2026 22:00:00 +0000

Type Values Removed Values Added
Description Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/J). Supported versions that are affected are 9.7.0-9.7.1. Difficult to exploit vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Connectors. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all MySQL Connectors accessible data as well as unauthorized access to critical data or complete access to all MySQL Connectors accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of MySQL Connectors. CVSS 3.1 Base Score 7.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L).
First Time appeared Oracle
Oracle mysql Connector\/j
CPEs cpe:2.3:a:oracle:mysql_connector\/j:*:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle mysql Connector\/j
References
Metrics cvssV3_1

{'score': 7.1, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L'}

Subscriptions

Oracle Mysql Connector/j Mysql Connector\/j Mysql Connectors
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-07-29T18:19:17.682Z

Reserved: 2026-07-08T15:51:40.548Z

Link: CVE-2026-60623

cve-icon Vulnrichment

Updated: 2026-07-29T18:19:14.488Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-04T17:15:02Z

Weaknesses
  • CWE-306

    Missing Authentication for Critical Function