CVE-2026-60747 - Vulnerability Details

- mysql: Replication unspecified vulnerability (CPU Jul 2026)

Description

Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication). Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and 9.7.0-9.7.1. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where MySQL Server, MySQL Cluster executes to compromise MySQL Server, MySQL Cluster. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 6.2 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).

Published: 2026-07-21

Score: 6.2 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

A local unauthenticated attacker who can log on to the infrastructure where Oracle MySQL Server or MySQL Cluster runs can exploit a replication component flaw to force the database engine to crash or hang, resulting in a complete denial of service. The weakness exposes the server’s availability level, allowing repeated failures without impacting confidentiality or integrity.

Affected Systems

Oracle MySQL Server versions 8.4.0 through 8.4.10 and 9.7.0 through 9.7.1, and Oracle MySQL Cluster versions 8.0.0 through 8.0.47, 8.4.0 through 8.4.10, and 9.7.0 through 9.7.1 are affected.

Risk and Exploitability

The CVSS v3.1 base score of 6.2 indicates moderate severity focused on availability (A:H). The EPSS score of <1% shows a very low probability of exploitation in the wild, and the vulnerability is not listed in CISA’s KEV catalog. Nevertheless, the flaw can be leveraged by any local user with infrastructure access, as the attack vector is inferred to be local. Successful exploitation results in repeated crashes or hangs that can disrupt services without requiring elevated permissions or network connectivity.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Oracle Corporation

MySQL Server

affected

Version	Status	Constraints
`8.4.0-8.4.10`	affected	—
`9.7.0-9.7.1`	affected	—

Oracle Corporation

MySQL Cluster

affected

Version	Status	Constraints
`8.0.0-8.0.47`	affected	—
`8.4.0-8.4.10`	affected	—
`9.7.0-9.7.1`	affected	—

Configuration 1 [-]

OR	cpe:2.3:a:oracle:mysql_server::::::::
	cpe:2.3:a:oracle:mysql_server:9.7.0:::::::*
	cpe:2.3:a:oracle:mysql_server:9.7.1:::::::*

Configuration 2 [-]

OR	cpe:2.3:a:oracle:mysql_cluster::::::::
	cpe:2.3:a:oracle:mysql_cluster::::::::
	cpe:2.3:a:oracle:mysql_cluster:9.7.0:::::::*
	cpe:2.3:a:oracle:mysql_cluster:9.7.1:::::::*

No data.

Vendor Product Confidence Versions

Oracle

Mysql Cluster

95%

Version	Status	Scheme	Platform
`[8.0.0,8.0.47]`	affected	semver	—
`[8.4.0,8.4.10]`	affected	semver	—
`[9.7.0,9.7.1]`	affected	semver	—

Oracle

Mysql Server

95%

Version	Status	Scheme	Platform
`[8.4.0,8.4.10]`	affected	semver	—
`[9.7.0,9.7.1]`	affected	semver	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Apply the latest Oracle MySQL Server or MySQL Cluster update (8.4.11 or later, 9.7.2 or later) to eliminate the replication flaw.
Configure MySQL to require authentication for local logins and disable the root account for local access to restrict unauthorized local users from exploiting the vulnerability.
If replication is not needed, disable it or restrict replication user privileges to the minimum required, reducing the attack surface for local breaches.

Generated by OpenCVE AI on August 4, 2026 at 02:53 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00138.

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://nvd.nist.gov/vuln/detail/CVE-2026-60747
https://www.cve.org/CVERecord?id=CVE-2026-60747
https://www.oracle.com/security-alerts/cpujul2026.html
https://www.oracle.com/security-alerts/cpujul2026.html#AppendixMSQL

History

Thu, 30 Jul 2026 13:30:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-399

Tue, 28 Jul 2026 00:15:00 +0000

Type	Values Removed	Values Added
Title	Unauthenticated Local Denial of Service in Oracle MySQL Server and Cluster via Replication	mysql: Replication unspecified vulnerability (CPU Jul 2026)
Weaknesses		CWE-770
References		https://nvd.nist.gov/vuln/detail/CVE-2026-60747 https://www.cve.org/CVERecord?id=CVE-2026-60747 https://www.oracle.com/security-alerts/cpujul2026.html#AppendixMSQL
Metrics	threat_severity `None`	threat_severity `Moderate`

Fri, 24 Jul 2026 19:30:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-400
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Thu, 23 Jul 2026 22:45:00 +0000

Type	Values Removed	Values Added
Title		Unauthenticated Local Denial of Service in Oracle MySQL Server and Cluster via Replication
Weaknesses		CWE-399

Tue, 21 Jul 2026 22:00:00 +0000

Type	Values Removed	Values Added
Description		Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication). Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and 9.7.0-9.7.1. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where MySQL Server, MySQL Cluster executes to compromise MySQL Server, MySQL Cluster. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 6.2 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
First Time appeared		Oracle Oracle mysql Cluster Oracle mysql Server
CPEs		cpe:2.3:a:oracle:mysql_cluster:::::::: cpe:2.3:a:oracle:mysql_server::::::::
Vendors & Products		Oracle Oracle mysql Cluster Oracle mysql Server
References		https://www.oracle.com/security-alerts/cpujul2026.html
Metrics		cvssV3_1 `{'score': 6.2, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}`

Subscriptions

Oracle Mysql Cluster Mysql Server

MITRE

Status: PUBLISHED

Assigner: oracle

Published: 2026-07-21T21:36:47.847Z

Updated: 2026-07-24T19:01:57.160Z

Reserved: 2026-07-08T15:51:55.587Z

Link: CVE-2026-60747

Vulnrichment

Updated: 2026-07-24T19:01:51.639Z

NVD

Status : Analyzed

Published: 2026-07-21T22:18:14.807

Modified: 2026-07-27T17:58:38.883

Link: CVE-2026-60747

Redhat

Severity : Moderate

Publid Date: 2026-07-21T00:00:00Z

Links: CVE-2026-60747 - Bugzilla

OpenCVE Enrichment

Updated: 2026-08-04T03:00:02Z

Weaknesses

CWE-400
Uncontrolled Resource Consumption
CWE-770
Allocation of Resources Without Limits or Throttling

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Exploitation none

Automatable no

Technical Impact partial

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object