CVE-2026-60317 in MySQL Connectors
Summary
by MITRE • 07/22/2026
Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/Net). Supported versions that are affected are 9.7.0-9.7.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Connectors. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all MySQL Connectors accessible data as well as unauthorized access to critical data or complete access to all MySQL Connectors accessible data. CVSS 3.1 Base Score 7.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N).
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 07/22/2026
This vulnerability resides within Oracle MySQL Connectors component known as Connector/Net, specifically affecting versions 9.7.0 through 9.7.1. The flaw represents a significant security weakness that can be exploited by unauthenticated attackers who have network access to the affected systems. The vulnerability's classification as difficult to exploit indicates that while it requires some technical skill or specific conditions to leverage, the attack surface remains substantial given the widespread use of MySQL connectors in enterprise environments.
The technical nature of this vulnerability allows for unauthorized modification of critical data through multiple network protocols, creating a pathway for attackers to perform unauthorized creation, deletion, and modification operations on all accessible MySQL Connectors data. This encompasses not only the data directly managed by the connector but also any sensitive information that flows through or is stored within the MySQL infrastructure. The CVSS 3.1 base score of 7.4 reflects the high impact potential with both confidentiality and integrity impacts rated as high, indicating that successful exploitation could lead to complete data compromise and modification capabilities.
From an operational standpoint, this vulnerability poses severe risks to organizations relying on MySQL Connectors for database connectivity and application integration. The unauthenticated nature means attackers can exploit the flaw without requiring valid credentials, making detection more challenging and potentially allowing for prolonged unauthorized access. The attack vector through multiple protocols suggests that various network communication channels could be leveraged, increasing the likelihood of successful exploitation across different network environments and configurations.
The security implications extend beyond immediate data compromise to include potential system-wide impacts on database integrity and information assurance. Organizations using affected versions should prioritize immediate remediation through patch updates from Oracle, as the vulnerability creates a persistent risk for data exposure and manipulation. This weakness aligns with CWE categories related to insufficient authentication mechanisms and inadequate access controls, representing a critical gap in the security posture of MySQL connector implementations. The ATT&CK framework would categorize this vulnerability under initial access and privilege escalation techniques, as it provides a pathway for attackers to establish persistent unauthorized access to database resources.
Mitigation strategies should include immediate patch deployment, network segmentation to limit exposure, and enhanced monitoring of database connection activities. Organizations should also conduct thorough assessments of their MySQL connector implementations to identify any additional vulnerabilities or misconfigurations that could compound the risk presented by this flaw. The vulnerability demonstrates the critical importance of maintaining up-to-date database connectivity components and implementing robust security controls around database access points to prevent unauthorized data manipulation and compromise.