This vulnerability (CVE-2026-60177) exists in the Clone Plugin component of Oracle MySQL Server and MySQL Cluster. It affects multiple versions of MySQL Server and MySQL Cluster, specifically versions 8.4.0 to 8.4.10 and 9.7.0 to 9.7.1 for MySQL Server, and 8.0.0 to 8.0.47, 8.4.0 to 8.4.10, and 9.7.0 to 9.7.1 for MySQL Cluster. The vulnerability allows a high privileged attacker with network access via multiple protocols to cause a hang or repeated crash, resulting in a denial of service condition. The CVSS 3.1 base score is 4.4, reflecting a medium severity with impact limited to availability. The vulnerability is difficult to exploit and does not affect confidentiality or integrity. Oracle's July 2026 Critical Patch Update advisory references this vulnerability among many others but does not explicitly state patch availability or remediation details for these specific affected versions in the provided excerpt.

Successful exploitation results in an unauthorized ability to cause a hang or frequent crash of MySQL Server or MySQL Cluster, leading to a complete denial of service. There is no impact on confidentiality or integrity. The attack requires high privileges and network access, and is difficult to exploit. No known exploits in the wild have been reported.

Oracle's July 2026 Critical Patch Update advisory includes this vulnerability in a large set of security patches. However, the provided advisory content does not explicitly confirm patch availability or remediation status for the affected MySQL Server and Cluster versions. Therefore, patch status is not yet confirmed — check the Oracle advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle strongly recommends applying security patches promptly on actively supported versions. Until a patch is confirmed, limit network access to MySQL Server and Cluster instances to trusted users with high privileges to reduce risk.