CVE-2026-60586: Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Connectors. While the vulnerability is in MySQL Connectors, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all MySQL Connectors accessible data. in Oracle Corporation MySQL Connectors
Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/J). Supported versions that are affected are 9.7.0-9.7.1. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Connectors. While the vulnerability is in MySQL Connectors, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all MySQL Connectors accessible data. CVSS 3.1 Base Score 7.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N).
AI Analysis
Technical Summary
This vulnerability exists in the MySQL Connectors product of Oracle MySQL, particularly in Connector/J component versions 9.7.0 to 9.7.1. It is easily exploitable by a low privileged attacker with network access via multiple protocols, resulting in unauthorized access to critical data or complete access to all data accessible through MySQL Connectors. The vulnerability causes a scope change, potentially impacting additional Oracle products beyond MySQL Connectors. The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, scope change, and high confidentiality impact with no impact on integrity or availability. Oracle’s July 2026 Critical Patch Update advisory lists this vulnerability among 1449 security patches but does not explicitly state the availability of a specific patch for MySQL Connectors in the advisory content provided.
Potential Impact
Successful exploitation of this vulnerability can lead to unauthorized access to critical data managed or accessible through MySQL Connectors. The scope change indicates that other Oracle products relying on MySQL Connectors may also be impacted. The confidentiality of data is highly affected, but there is no impact on data integrity or system availability. This could result in significant data exposure risks for affected environments.
Mitigation Recommendations
Oracle has included this vulnerability in its July 2026 Critical Patch Update, which contains numerous security patches across Oracle products including MySQL Connectors versions 9.7.0 to 9.7.1. Customers are strongly advised to review the Oracle Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html and apply the relevant patches promptly. Patch status is not explicitly confirmed for MySQL Connectors in the advisory excerpt, so customers should verify patch availability and installation instructions in the official Oracle advisory. No vendor advisory states that no action is required or that the issue is already mitigated, so applying the official patches is recommended.
CVE-2026-60586: Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Connectors. While the vulnerability is in MySQL Connectors, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all MySQL Connectors accessible data. in Oracle Corporation MySQL Connectors
Description
Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/J). Supported versions that are affected are 9.7.0-9.7.1. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Connectors. While the vulnerability is in MySQL Connectors, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all MySQL Connectors accessible data. CVSS 3.1 Base Score 7.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N).
CVSS v3.1
Score 7.7high
Affected software
pkg:maven/com.oracle.mysql/mysql-connectorRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability exists in the MySQL Connectors product of Oracle MySQL, particularly in Connector/J component versions 9.7.0 to 9.7.1. It is easily exploitable by a low privileged attacker with network access via multiple protocols, resulting in unauthorized access to critical data or complete access to all data accessible through MySQL Connectors. The vulnerability causes a scope change, potentially impacting additional Oracle products beyond MySQL Connectors. The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, scope change, and high confidentiality impact with no impact on integrity or availability. Oracle’s July 2026 Critical Patch Update advisory lists this vulnerability among 1449 security patches but does not explicitly state the availability of a specific patch for MySQL Connectors in the advisory content provided.
Potential Impact
Successful exploitation of this vulnerability can lead to unauthorized access to critical data managed or accessible through MySQL Connectors. The scope change indicates that other Oracle products relying on MySQL Connectors may also be impacted. The confidentiality of data is highly affected, but there is no impact on data integrity or system availability. This could result in significant data exposure risks for affected environments.
Mitigation Recommendations
Oracle has included this vulnerability in its July 2026 Critical Patch Update, which contains numerous security patches across Oracle products including MySQL Connectors versions 9.7.0 to 9.7.1. Customers are strongly advised to review the Oracle Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html and apply the relevant patches promptly. Patch status is not explicitly confirmed for MySQL Connectors in the advisory excerpt, so customers should verify patch availability and installation instructions in the official Oracle advisory. No vendor advisory states that no action is required or that the issue is already mitigated, so applying the official patches is recommended.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- oracle
- Date Reserved
- 2026-07-08T15:51:40.546Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
- Vendor Advisory Urls
- [{"url":"https://www.oracle.com/security-alerts/cpujul2026.html","vendor":"Oracle"}]
Threat ID: 6a5fedf99c2644c7f8d5a641
Added to database: 07/21/2026, 22:08:57 UTC
Last enriched: 07/29/2026, 21:17:04 UTC
Last updated: 08/31/2026, 22:52:12 UTC
Views: 49
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.