CVE-2026-60190 is a vulnerability in the replication component of Oracle MySQL Server and MySQL Cluster. It affects multiple versions of MySQL Server and MySQL Cluster, specifically versions 8.4.0 to 8.4.10 and 9.7.0 to 9.7.1 for MySQL Server, and 8.0.0 to 8.0.47, 8.4.0 to 8.4.10, and 9.7.0 to 9.7.1 for MySQL Cluster. The vulnerability allows a high privileged attacker with network access via multiple protocols to cause a partial denial of service (availability impact) without compromising confidentiality or integrity. The CVSS 3.1 base score is 2.2, indicating low severity. Oracle's July 2026 Critical Patch Update advisory includes this vulnerability among 1449 patches but does not explicitly confirm the availability of a specific patch for this CVE. No known exploits in the wild have been reported.

Successful exploitation of this vulnerability can result in unauthorized partial denial of service (partial DOS) of MySQL Server and MySQL Cluster. There is no impact on confidentiality or integrity. The attack requires high privileges and network access via multiple protocols. The overall severity is low with a CVSS 3.1 base score of 2.2.

Oracle has included this vulnerability in its July 2026 Critical Patch Update advisory, which contains numerous security patches across Oracle products including MySQL Server and MySQL Cluster. However, the advisory does not explicitly confirm the availability of a specific patch for CVE-2026-60190. Users should review the Oracle advisory at https://www.oracle.com/security-alerts/cpujul2026.html for the latest patch availability and apply all relevant security updates promptly. Until a patch is confirmed and applied, monitoring and restricting high privileged network access to MySQL services is advisable. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.