CVE-2026-60179 in MySQL Connectors
Summary
by MITRE • 07/22/2026
Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/C++). Supported versions that are affected are 9.7.0-9.7.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Connectors. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all MySQL Connectors accessible data as well as unauthorized access to critical data or complete access to all MySQL Connectors accessible data. CVSS 3.1 Base Score 7.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N).
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 07/22/2026
This vulnerability exists within Oracle MySQL Connectors, specifically in the Connector/C++ component affecting versions 9.7.0 through 9.7.1. The flaw represents a significant security weakness that can be exploited by unauthenticated attackers who have network access to the affected system. The vulnerability's classification as difficult to exploit indicates that while it requires some technical knowledge or specific conditions to leverage, the potential impact remains severe enough to warrant immediate attention. The attack vector is network-based, meaning that an attacker does not need physical access to the system but can potentially target the MySQL Connectors through multiple network protocols.
The technical nature of this vulnerability allows for unauthorized modification of critical data within the MySQL Connectors environment. Attackers who successfully exploit this weakness can gain the ability to create, delete, or modify data across all accessible MySQL Connectors resources. This encompasses both the structural integrity and confidentiality aspects of the database system, as the vulnerability affects the fundamental data protection mechanisms that should prevent unauthorized access. The impact extends beyond simple data corruption to include complete compromise of sensitive information stored within the connected database systems.
From an operational perspective, this vulnerability poses a substantial risk to organizations relying on MySQL Connectors for their database connectivity needs. The CVSS 3.1 base score of 7.4 indicates a high severity threat level that can result in significant data breaches and system compromise. The attack requires high network access complexity but offers substantial confidentiality and integrity impacts, making it particularly dangerous for environments where sensitive data is stored or processed through MySQL Connectors. Organizations using affected versions face potential unauthorized access to all critical data accessible through the connectors, which could include customer information, financial records, or proprietary business data.
The vulnerability's exploitation presents multiple attack pathways through various network protocols, increasing the attack surface and complicating defensive measures. This characteristic aligns with ATT&CK framework concepts related to network service scanning and exploitation of software vulnerabilities. The lack of authentication requirements means that attackers can potentially target these systems without prior credentials or insider knowledge, making the threat more pervasive. Organizations should consider implementing network segmentation, access controls, and monitoring solutions to detect unauthorized access attempts targeting MySQL Connectors.
Effective mitigation strategies include immediate patching of affected versions to 9.7.2 or later releases where the vulnerability has been addressed. Network administrators should implement firewall rules to restrict unnecessary access to MySQL Connectors ports and services, while also deploying intrusion detection systems to monitor for suspicious network activity. The CWE classification for this type of vulnerability typically relates to improper access control mechanisms and insufficient input validation within database connectivity components. Regular security assessments and vulnerability scans should be conducted to identify other potential weaknesses in the database infrastructure that could compound the risk from this specific vulnerability. Organizations must also consider implementing data loss prevention measures and maintaining detailed audit logs to detect unauthorized data modifications or access attempts that may indicate exploitation of this vulnerability.