This vulnerability (CVE-2026-60186) exists in the Group Replication Plugin component of Oracle MySQL Server and MySQL Cluster. It affects multiple specified versions of MySQL Server and MySQL Cluster. The flaw allows a high privileged attacker with network access to cause a hang or repeated crash of the server, resulting in a denial of service condition. The vulnerability is rated medium severity with a CVSS 3.1 base score of 4.4, primarily impacting availability (AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H). The Oracle July 2026 Critical Patch Update advisory mentions this vulnerability among many others but does not provide explicit details on patch availability or remediation for this specific issue. No known exploits in the wild have been reported.

Successful exploitation results in a denial of service condition by causing the MySQL Server or MySQL Cluster to hang or crash repeatedly. There is no impact on confidentiality or integrity. The attacker must have high privileges and network access via multiple protocols. The vulnerability does not allow unauthorized data access or modification but can disrupt availability of the database service.

The Oracle July 2026 Critical Patch Update advisory lists this vulnerability but does not explicitly confirm patch availability or remediation status for the affected MySQL versions. Patch status is not yet confirmed — check the Oracle advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle strongly recommends applying security patches promptly for supported versions. Until a patch is confirmed, limit network access to MySQL Server and Cluster instances to trusted users with high privileges to reduce risk.