This vulnerability (CVE-2026-60332) affects Oracle MySQL Server and MySQL Cluster in the Server: Group Replication GCS component. It allows a high privileged attacker who already has logon access to the infrastructure hosting the MySQL Server or Cluster to compromise the system, potentially resulting in full takeover. The vulnerability is rated medium severity with a CVSS 3.1 score of 6.4, reflecting high impact on confidentiality, integrity, and availability, but requiring high attack complexity and privileges. Affected versions are MySQL Server 8.4.0-8.4.10 and 9.7.0-9.7.1, and MySQL Cluster 8.0.0-8.0.47, 8.4.0-8.4.10, and 9.7.0-9.7.1. Oracle's July 2026 Critical Patch Update advisory mentions this vulnerability among many others but does not explicitly state patch availability or remediation level for these versions in the provided content.

Successful exploitation can lead to complete compromise and takeover of the MySQL Server or MySQL Cluster, impacting confidentiality, integrity, and availability of the affected systems. The attacker must have high privileges and logon access to the infrastructure, and the attack complexity is high. There are no known exploits in the wild as per the provided data.

Oracle's July 2026 Critical Patch Update advisory references this vulnerability but does not explicitly confirm patch availability or remediation status for the affected versions. Patch status is not yet confirmed — check the Oracle advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle strongly recommends applying security patches promptly and remaining on actively supported versions. Until official patches or mitigations are confirmed, restrict high privileged access to infrastructure hosting MySQL Server and Cluster to trusted personnel only.