CVE-2026-60315 is a vulnerability in Oracle MySQL Server and MySQL Cluster's Server: X Plugin component. It affects multiple supported versions, specifically MySQL Server versions 8.4.0 to 8.4.10 and 9.7.0 to 9.7.1, and MySQL Cluster versions 8.0.0 to 8.0.47, 8.4.0 to 8.4.10, and 9.7.0 to 9.7.1. The flaw allows an unauthenticated attacker with network access via multiple protocols to cause a hang or repeated crash, resulting in a complete denial of service, and to read unauthorized subsets of accessible data. The CVSS 3.1 base score is 8.2, reflecting low complexity attack vector with no privileges or user interaction required, impacting confidentiality (partial data disclosure) and availability (complete denial of service). Oracle's Critical Patch Update for July 2026 includes patches addressing this vulnerability, as detailed in their advisory.

Successful exploitation can lead to unauthorized partial read access to data on the affected MySQL Server or Cluster and cause a complete denial of service by hanging or crashing the server. This impacts the confidentiality and availability of the database service but does not affect data integrity. The vulnerability is exploitable remotely without authentication, increasing its risk.

Oracle has released patches for this vulnerability as part of the July 2026 Critical Patch Update. Users should apply the relevant patches promptly to affected MySQL Server and MySQL Cluster versions. Oracle strongly recommends remaining on actively supported versions and applying security patches without delay. No alternative mitigations or workarounds are specified in the advisory.