Threat Intelligence Database

Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Group Replication GCS). Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and 9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where MySQL Server, MySQL Cluster executes to compromise MySQL Server, MySQL Cluster. Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 6.4 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H).

CVE-2026-60311 is a vulnerability in Oracle MySQL Server and MySQL Cluster affecting versions 9.0.0 through 9.7.1. It allows a low privileged attacker with network access via multiple protocols to cause a denial of service by hanging or crashing the server. The vulnerability impacts availability but does not affect confidentiality or integrity. The CVSS 3.1 base score is 6.5, indicating a medium severity. Oracle has published a Critical Patch Update advisory referencing this vulnerability but does not explicitly confirm patch availability or remediation status for these versions. No known exploits in the wild have been reported.

CVE-2026-60194 is a vulnerability in Oracle MySQL Server and MySQL Cluster versions 9.7.0 through 9.7.1 affecting the Server: JSON Duality component. It allows a high privileged attacker with network access via multiple protocols to cause a denial of service by hanging or crashing the server. The vulnerability has a CVSS 3.1 base score of 4.9, indicating a medium severity primarily impacting availability. No official patch or remediation level has been explicitly stated in the vendor advisory as of the publication date. Oracle recommends applying security patches promptly from their Critical Patch Update advisories. No known exploits in the wild have been reported.

CVE-2026-60190 is a low-severity vulnerability in Oracle MySQL Server and MySQL Cluster affecting specific versions. It allows a high privileged attacker with network access via multiple protocols to cause a partial denial of service (partial DOS). The vulnerability is difficult to exploit and impacts availability without affecting confidentiality or integrity. Affected versions include MySQL Server 8.4.0 through 8.4.10 and 9.7.0 through 9.7.1, as well as MySQL Cluster 8.0.0 through 8.0.47, 8.4.0 through 8.4.10, and 9.7.0 through 9.7.1. Oracle has released a Critical Patch Update advisory covering this vulnerability, but the specific patch status for this CVE is not explicitly confirmed in the advisory. Users should consult the Oracle advisory for the latest patch information and apply updates promptly.

CVE-2026-60189 is a vulnerability in Oracle MySQL Server and MySQL Cluster affecting specific versions. It allows a high privileged attacker with network access via multiple protocols to cause a hang or repeated crash, resulting in a denial of service (DoS). The vulnerability is difficult to exploit and does not impact confidentiality or integrity. The CVSS 3.1 base score is 4.4, indicating medium severity. Affected versions include MySQL Server 8.4.0 through 8.4.10 and 9.7.0 through 9.7.1, as well as MySQL Cluster 8.0.0 through 8.0.47, 8.4.0 through 8.4.10, and 9.7.0 through 9.7.1. Oracle has released a Critical Patch Update in July 2026 addressing this and many other vulnerabilities. Users are strongly advised to apply the available patches promptly.

CVE-2026-60188 is a vulnerability in Oracle MySQL Server and MySQL Cluster affecting specific versions. It allows a high privileged attacker with network access via multiple protocols to cause a hang or repeated crash, resulting in a denial of service (DoS). The vulnerability is difficult to exploit and impacts availability without compromising confidentiality or integrity. The affected versions include MySQL Server 8.4.0 through 8.4.10 and 9.7.0 through 9.7.1, as well as MySQL Cluster 8.0.0 through 8.0.47, 8.4.0 through 8.4.10, and 9.7.0 through 9.7.1. Oracle has published a Critical Patch Update advisory that includes patches for this and other vulnerabilities. No known exploits are reported in the wild at this time.

CVE-2026-60187 is a medium severity vulnerability in Oracle MySQL Server and MySQL Cluster affecting specific versions. It allows a high privileged attacker with network access via multiple protocols to cause a hang or repeated crash, resulting in a denial of service (DoS). The vulnerability is difficult to exploit and does not impact confidentiality or integrity. The affected versions include MySQL Server 8.4.0 through 8.4.10 and 9.7.0 through 9.7.1, as well as MySQL Cluster 8.0.0 through 8.0.47, 8.4.0 through 8.4.10, and 9.7.0 through 9.7.1. Oracle has published a Critical Patch Update advisory that includes patches for this vulnerability.

CVE-2026-60186 is a vulnerability in Oracle MySQL Server and MySQL Cluster affecting specific versions. It allows a high privileged attacker with network access via multiple protocols to cause a denial of service by hanging or crashing the server. The vulnerability impacts availability but does not affect confidentiality or integrity. The CVSS 3.1 base score is 4.4, indicating medium severity. Affected versions include MySQL Server 8.4.0 through 8.4.10 and 9.7.0 through 9.7.1, and MySQL Cluster 8.0.0 through 8.0.47, 8.4.0 through 8.4.10, and 9.7.0 through 9.7.1. Oracle's July 2026 Critical Patch Update advisory references this vulnerability but does not explicitly confirm patch availability or remediation status for these versions.

CVE-2026-60185 is a vulnerability in Oracle MySQL Server and MySQL Cluster affecting specific versions. It allows a high privileged attacker with network access via multiple protocols to cause a hang or repeated crash, resulting in a denial of service (DoS). The vulnerability is difficult to exploit and impacts availability without compromising confidentiality or integrity. The CVSS 3.1 base score is 4.4, indicating medium severity. Oracle has included this vulnerability in its July 2026 Critical Patch Update advisory, which contains numerous patches across products including MySQL Server and MySQL Cluster.

CVE-2026-60184 is a vulnerability in Oracle MySQL Server and MySQL Cluster affecting certain versions. It allows a high privileged attacker with network access via multiple protocols to cause a denial of service by hanging or crashing the server. The vulnerability impacts availability but does not affect confidentiality or integrity. The CVSS 3.1 base score is 4.4, indicating medium severity. Affected versions include MySQL Server 8.4.0 through 8.4.10 and 9.7.0 through 9.7.1, as well as MySQL Cluster 8.0.0 through 8.0.47, 8.4.0 through 8.4.10, and 9.7.0 through 9.7.1. Oracle has released a Critical Patch Update in July 2026 addressing this and many other vulnerabilities. No specific patch link for this CVE was provided, but Oracle strongly recommends applying the available security patches promptly.