This vulnerability affects Oracle MySQL Router component versions 8.4.0-8.4.10 and 9.7.0-9.7.1. It is a difficult to exploit vulnerability that allows an unauthenticated attacker with network access via HTTP to compromise the MySQL Router. Successful exploitation can result in unauthorized creation, deletion, or modification of critical data or all data accessible through MySQL Router, as well as unauthorized access to critical or complete data. The CVSS 3.1 vector indicates network attack vector, high attack complexity, no privileges required, no user interaction, unchanged scope, and high confidentiality and integrity impacts with no availability impact. The vulnerability is categorized under CWE-284 (Improper Access Control). Oracle’s July 2026 Critical Patch Update advisory lists MySQL Router among affected products but does not explicitly confirm the availability of a patch or remediation level for this specific vulnerability.

Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data accessible via MySQL Router, as well as unauthorized access to critical or all data accessible through the router. This compromises confidentiality and integrity of the data but does not affect availability. The vulnerability requires network access via HTTP and is difficult to exploit, with no privileges or user interaction required.

Oracle’s July 2026 Critical Patch Update advisory includes MySQL Router among affected products and strongly recommends applying security patches without delay. However, the specific patch or remediation status for CVE-2026-60725 is not explicitly confirmed in the advisory content provided. Users should monitor Oracle’s official security advisories and apply any available patches promptly once confirmed. Until a patch is confirmed, restrict network access to MySQL Router instances to trusted sources to reduce exposure. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.