CVE-2026-60317 is a vulnerability in Oracle MySQL Connectors (component Connector/Net) affecting version 9.7.0. It allows an unauthenticated attacker with network access and high attack complexity to compromise the product via multiple protocols. The impact includes unauthorized creation, deletion, or modification of critical data and unauthorized access to all data accessible through MySQL Connectors. The CVSS 3.1 vector is AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N, reflecting network attack vector, high complexity, no privileges or user interaction required, and high confidentiality and integrity impact without availability impact. The vulnerability is listed in Oracle's July 2026 Critical Patch Update advisory, which contains numerous patches for various Oracle products, including MySQL Connectors versions 9.7.0-9.7.1. The advisory emphasizes the importance of applying patches promptly but does not explicitly state the patch status for this specific CVE.

Successful exploitation of this vulnerability can result in unauthorized creation, deletion, or modification of critical data, as well as unauthorized access to all data accessible via MySQL Connectors. This compromises both confidentiality and integrity of the affected data. There is no reported impact on availability. The vulnerability is difficult to exploit and requires network access with high attack complexity but no authentication or user interaction.

Oracle's July 2026 Critical Patch Update advisory includes this vulnerability among many others and strongly recommends that customers apply security patches without delay. However, the advisory does not explicitly confirm the availability of a specific patch for CVE-2026-60317. Therefore, patch status is not yet confirmed—check the Oracle advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Customers should remain on actively supported versions and apply all relevant security updates as soon as they become available.