CVE-2026-60331 is a vulnerability in the replication component of Oracle MySQL Server and MySQL Cluster. It affects MySQL Server versions 8.4.0 to 8.4.10 and 9.7.0 to 9.7.1, and MySQL Cluster versions 8.0.0 to 8.0.47, 8.4.0 to 8.4.10, and 9.7.0 to 9.7.1. The vulnerability allows a high privileged attacker with logon access to the infrastructure hosting MySQL to compromise and potentially take over the MySQL Server or Cluster. The CVSS 3.1 base score is 6.4, reflecting medium severity with high impact on confidentiality, integrity, and availability. Oracle's July 2026 Critical Patch Update advisory includes security patches for MySQL products among many others, but does not explicitly confirm patch availability for this specific vulnerability. Users should review the advisory and apply relevant patches promptly.

Successful exploitation of this vulnerability can lead to full compromise of the MySQL Server or MySQL Cluster, impacting confidentiality, integrity, and availability of the database systems. However, exploitation is difficult and requires a high privileged attacker with existing logon access to the infrastructure where MySQL is running.

Oracle's July 2026 Critical Patch Update advisory addresses this vulnerability among many others. Customers are strongly recommended to remain on actively supported versions and apply Oracle's security patches without delay. Patch status for this specific vulnerability is not explicitly confirmed; therefore, users should consult the Oracle advisory at https://www.oracle.com/security-alerts/cpujul2026.html for the latest patch availability and installation instructions. No vendor statement indicates that no action is required or that the issue is already mitigated.