This vulnerability (CVE-2026-60191) exists in the replication component of Oracle MySQL Server and MySQL Cluster. It is difficult to exploit and requires a high privileged attacker with logon access to the infrastructure where the MySQL Server or Cluster is running. Successful exploitation can cause a hang or frequent crashes, resulting in a complete denial of service (DoS). The CVSS vector indicates local attack vector, high attack complexity, high privileges required, no user interaction, unchanged scope, no confidentiality or integrity impact, and high availability impact. Affected versions explicitly include MySQL Server 8.4.0-8.4.10, 9.7.0-9.7.1, and MySQL Cluster 8.0.0-8.0.47, 8.4.0-8.4.10, 9.7.0-9.7.1. Oracle's July 2026 Critical Patch Update advisory references this vulnerability among many others but does not provide a direct patch link or remediation level in the data provided. Customers are advised to apply Oracle Critical Patch Updates promptly as per Oracle's general guidance.

The vulnerability allows a high privileged attacker with logon access to cause a denial of service by hanging or crashing MySQL Server or MySQL Cluster. There is no impact on confidentiality or integrity, only availability is affected. This can disrupt database services and cause downtime.

Oracle's July 2026 Critical Patch Update advisory includes security patches addressing this vulnerability. Although no explicit patch link or remediation level is provided in the input data, Oracle strongly recommends applying the Critical Patch Update without delay to mitigate this and other vulnerabilities. Customers should verify patch availability and installation instructions from the official Oracle advisory at https://www.oracle.com/security-alerts/cpujul2026.html. No vendor advisory states that no action is required or that the issue is already mitigated, so patching is the recommended mitigation.