CVE-2026-60331
Summary
by MITRE • 07/22/2026
Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication). Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and 9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where MySQL Server, MySQL Cluster executes to compromise MySQL Server, MySQL Cluster. Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 6.4 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H).
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 07/22/2026
This vulnerability resides within the replication component of MySQL Server and MySQL Cluster products, representing a significant security weakness that could lead to complete system compromise when exploited by attackers with sufficient privileges. The affected versions span multiple release lines including MySQL Server 8.4.0-8.4.10 and 9.7.0-9.7.1, alongside MySQL Cluster versions 8.0.0-8.0.47, 8.4.0-8.4.10, and 9.7.0-9.7.1, indicating a broad impact across the product portfolio. The vulnerability's classification as difficult to exploit suggests that while it requires specific conditions and attacker privileges, once these are met, the consequences can be severe.
The technical nature of this flaw lies within the replication functionality that governs how data is synchronized between different MySQL instances. This component typically handles database consistency and data distribution across multiple servers, making it a critical part of the system architecture. When compromised, this vulnerability allows an attacker with local access to the infrastructure where MySQL operates to gain complete control over the database server. The CVSS 3.1 score of 6.4 reflects the high impact across confidentiality, integrity, and availability domains, indicating that successful exploitation could result in comprehensive system compromise.
The operational impact of this vulnerability extends beyond simple data theft or modification, as it enables full system takeover capabilities that could disrupt business operations and compromise sensitive information assets. Attackers with local logon privileges can leverage this weakness to elevate their access level and potentially move laterally within the network infrastructure where MySQL servers operate. The attack vector requires local access (AV:L) and high privilege requirements (PR:H), suggesting that while it may not be easily exploitable from external networks, internal threats or compromised accounts pose significant risks. The high complexity requirement (AC:H) indicates that additional technical expertise is needed to successfully execute the attack, though this does not mitigate the severity of potential consequences.
Organizations running affected MySQL versions should prioritize immediate remediation through official patches provided by Oracle, as these vulnerabilities could enable attackers to gain complete control over database systems containing potentially sensitive or critical business data. The vulnerability's impact across multiple release lines underscores the importance of comprehensive patch management strategies and regular security assessments to identify and address similar weaknesses in database infrastructure components.
This vulnerability aligns with CWE-284 (Improper Access Control) and may relate to ATT&CK techniques involving privilege escalation and persistence mechanisms, as the flaw enables attackers to gain elevated system access through legitimate local account credentials. The replication component's role in maintaining data consistency makes it a particularly attractive target for attackers seeking to establish persistent access or disrupt database operations across distributed systems. Security teams should implement network segmentation controls and monitor for unusual replication activities that might indicate exploitation attempts, while also ensuring proper access controls and least privilege principles are enforced on database infrastructure components.