CVE-2026-46860 is a critical security vulnerability in Oracle MySQL Router (component: Router: General) affecting versions 8.4.0 through 9.7.0. It allows an unauthenticated attacker with network access via HTTP to compromise the MySQL Router, potentially leading to full takeover. The vulnerability is rated with a CVSS 3.1 base score of 9.8, reflecting high impact on confidentiality, integrity, and availability. Oracle's June 2026 Critical Security Patch Update addresses this vulnerability among 245 others across multiple Oracle products. The advisory urges customers to apply the update promptly but does not provide explicit patch links or confirm patch availability specifically for MySQL Router. Mitigation may include blocking network protocols required by the attack or removing unnecessary privileges, though these may impact functionality.

Successful exploitation allows an unauthenticated remote attacker to fully compromise MySQL Router, resulting in complete loss of confidentiality, integrity, and availability of the affected component. This can lead to takeover of MySQL Router, potentially impacting the security and operation of systems relying on it.

Oracle strongly recommends applying the June 2026 Critical Security Patch Update as soon as possible to address this vulnerability. Until patches are applied, risk may be reduced by blocking network protocols required by the attack or removing unnecessary privileges from users, though these measures may disrupt normal application functionality. Patch status for MySQL Router is not explicitly confirmed in the advisory; users should consult the Oracle advisory at https://www.oracle.com/security-alerts/cspujun2026.html for the latest patch availability and installation instructions.