CVE-2026-61081 is a vulnerability in the Performance Schema component of Oracle MySQL Server and MySQL Cluster. It affects MySQL Server versions 8.4.0 to 8.4.10 and 9.7.0 to 9.7.1, and MySQL Cluster versions 8.0.0 to 8.0.47, 8.4.0 to 8.4.10, and 9.7.0 to 9.7.1. The flaw allows a high privileged attacker with network access via multiple protocols to compromise the server, resulting in unauthorized read access to a subset of accessible data. The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N) indicates network attack vector, low attack complexity, high privileges required, no user interaction, unchanged scope, and limited confidentiality impact. Oracle's July 2026 Critical Patch Update includes patches addressing this vulnerability among 1449 others. The vendor strongly recommends applying these patches without delay.

Successful exploitation of this vulnerability allows a high privileged attacker with network access to gain unauthorized read access to some data accessible by MySQL Server or MySQL Cluster. The impact is limited to confidentiality with no integrity or availability effects. The CVSS score of 2.7 reflects this low-severity confidentiality impact.

Oracle has released patches for this vulnerability as part of the July 2026 Critical Patch Update. Users should apply the relevant patches for their affected MySQL Server and MySQL Cluster versions promptly. Oracle strongly recommends remaining on actively supported versions and applying security patches without delay. Patch status is confirmed by the vendor advisory at https://www.oracle.com/security-alerts/cpujul2026.html.