CVE-2026-60316 is a vulnerability in the Oracle MySQL Server and MySQL Cluster products, specifically in the Server: X Plugin component. It affects MySQL Server versions 8.4.0-8.4.10 and 9.7.0-9.7.1, and MySQL Cluster versions 8.0.0-8.0.47, 8.4.0-8.4.10, and 9.7.0-9.7.1. The flaw allows a high privileged attacker with network access via multiple protocols to compromise the server or cluster, potentially resulting in full takeover. The CVSS 3.1 base score is 7.2, indicating high severity with impacts on confidentiality, integrity, and availability. Oracle's July 2026 Critical Patch Update advisory includes this vulnerability among 1449 security patches. The vendor strongly recommends applying the patches promptly to mitigate the risk.

Successful exploitation of this vulnerability can lead to complete compromise of the MySQL Server or MySQL Cluster, affecting confidentiality, integrity, and availability of the database systems. This could allow an attacker with high privileges and network access to take over the affected MySQL instances.

Oracle has released patches for this vulnerability as part of the July 2026 Critical Patch Update. Customers should apply the relevant patches promptly to affected MySQL Server and MySQL Cluster versions. Oracle strongly recommends remaining on actively supported versions and applying security patches without delay. Patch status is confirmed by the vendor advisory. No additional mitigation steps are indicated beyond applying the official patches.