CVE-2026-60315 is a vulnerability in the Oracle MySQL Server and MySQL Cluster products, specifically in the Server: X Plugin component. It affects multiple supported versions of MySQL Server (8.4.0-8.4.10, 9.7.0-9.7.1) and MySQL Cluster (8.0.0-8.0.47, 8.4.0-8.4.10, 9.7.0-9.7.1). The vulnerability allows an unauthenticated attacker with network access via multiple protocols to cause a hang or crash of the MySQL Server or Cluster (resulting in denial of service) and to gain unauthorized read access to a subset of accessible data. The CVSS 3.1 base score is 8.2, reflecting low complexity, no required privileges or user interaction, and impacts on confidentiality (partial) and availability (high). Oracle's July 2026 Critical Patch Update advisory mentions this vulnerability among many others but does not explicitly state patch availability or remediation details for this specific issue in the provided excerpt.

Successful exploitation can lead to denial of service by causing the MySQL Server or Cluster to hang or crash repeatedly. Additionally, it allows unauthorized read access to some accessible data, impacting confidentiality. There is no reported impact on data integrity. The vulnerability is exploitable remotely without authentication, increasing its risk.

Oracle has included this vulnerability in its July 2026 Critical Patch Update advisory. However, the provided advisory content does not explicitly confirm the availability of a patch or official remediation for the affected MySQL versions. Customers are strongly advised to review the Oracle advisory directly at https://www.oracle.com/security-alerts/cpujul2026.html for the latest patch availability and apply any relevant security updates promptly. Until a patch is confirmed and applied, consider restricting network access to MySQL services to trusted hosts only to reduce exposure.