CVE-2026-60184 is a denial-of-service vulnerability in the replication component of Oracle MySQL Server and MySQL Cluster. It affects MySQL Server versions 8.4.0 to 8.4.10 and 9.7.0 to 9.7.1, and MySQL Cluster versions 8.0.0 to 8.0.47, 8.4.0 to 8.4.10, and 9.7.0 to 9.7.1. The vulnerability requires a high privileged attacker with network access via multiple protocols. Successful exploitation results in the ability to cause the server to hang or crash repeatedly, leading to a complete denial of service. The CVSS 3.1 vector indicates network attack vector, high attack complexity, high privileges required, no user interaction, unchanged scope, no confidentiality or integrity impact, and high availability impact. Oracle's July 2026 Critical Patch Update advisory includes this vulnerability among 1449 security patches, recommending customers apply patches without delay.

The vulnerability allows a high privileged attacker with network access to cause a hang or frequent crash of MySQL Server or MySQL Cluster, resulting in a complete denial of service. There is no impact on confidentiality or integrity. The availability impact is rated high, but the overall CVSS score is medium (4.4) due to the high attack complexity and required privileges.

Oracle has included fixes for this vulnerability in its July 2026 Critical Patch Update. Customers are strongly advised to apply the available security patches promptly to mitigate this vulnerability. No specific patch link for this CVE was provided, so users should refer to the Oracle Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for patch availability and installation instructions. No alternative mitigations or workarounds are indicated in the advisory.