CVE-2026-60180 in MySQL Connectors
Summary
by MITRE • 07/22/2026
Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/C++). Supported versions that are affected are 9.7.0-9.7.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Connectors. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Connectors. CVSS 3.1 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 07/22/2026
This vulnerability exists within Oracle MySQL Connectors, specifically in the Connector/C++ component, affecting versions 9.7.0 through 9.7.1. The flaw represents a significant security weakness that can be exploited by unauthenticated attackers who have network access to the affected system. The vulnerability's exploitability is rated as easily accessible, meaning that threat actors with minimal technical expertise and network connectivity can potentially leverage this weakness against targeted systems.
The technical nature of this vulnerability allows for a complete denial of service condition where an attacker can cause the MySQL Connectors to hang or repeatedly crash. This type of attack specifically targets the availability aspect of the system's security posture, as demonstrated by the CVSS 3.1 Base Score of 7.5 which is categorized under availability impacts. The vulnerability can be triggered through multiple network protocols, expanding the potential attack surface and making it more challenging to defend against.
The operational impact of this vulnerability extends beyond simple service disruption, as the complete denial of service condition can severely impact database connectivity for applications relying on MySQL Connectors. Organizations using affected versions may experience significant downtime and operational disruptions when this vulnerability is exploited. The fact that the attack requires no authentication credentials or user interaction makes it particularly dangerous in environments where network exposure is inevitable.
From a cybersecurity framework perspective, this vulnerability aligns with CWE-400 which addresses "Uncontrolled Resource Consumption" and represents a classic availability-focused attack vector. The ATT&CK framework would categorize this under the T1499.004 subtechnique for "Endpoint Denial of Service" where adversaries target system resources to prevent normal operations. Organizations should prioritize immediate patching of affected versions while implementing network segmentation controls to limit exposure of database connectors to unnecessary network access.
The vulnerability's CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) clearly indicates that it requires no network proximity, has low attack complexity, does not require privileges or user interaction, and affects the system's availability completely. This scoring model suggests that organizations should treat this vulnerability as a high-priority concern requiring immediate remediation to prevent potential service disruption across database-dependent applications.