CVE-2026-60586
Summary
by MITRE • 07/22/2026
Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/J). Supported versions that are affected are 9.7.0-9.7.1. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Connectors. While the vulnerability is in MySQL Connectors, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all MySQL Connectors accessible data. CVSS 3.1 Base Score 7.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N).
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 07/22/2026
This vulnerability resides within Oracle MySQL Connectors specifically in the Connector/J component affecting versions 9.7.0 through 9.7.1. The flaw represents a security weakness that can be exploited by attackers with low privileges who possess network access capabilities. The vulnerability operates across multiple protocols and presents an easily exploitable threat vector that can compromise the entire MySQL Connectors infrastructure. From a cybersecurity perspective, this vulnerability aligns with CWE-284 which addresses improper access control mechanisms, specifically targeting authentication and authorization controls within database connectivity components.
The technical implementation of this vulnerability likely involves weaknesses in how Connector/J handles network connections or authentication processes, potentially allowing unauthorized users to bypass normal access controls. Attackers can leverage this flaw through network-based exploitation methods without requiring elevated privileges initially. The scope of impact extends beyond just the MySQL Connectors itself, creating a cascading effect that can compromise additional affected products within the broader Oracle MySQL ecosystem. This characteristic places the vulnerability in the ATT&CK framework under privilege escalation and persistence tactics where initial low-privilege access can be leveraged for more significant system compromise.
The operational impact of successful exploitation is severe and potentially catastrophic for database security. Attackers who successfully exploit this vulnerability gain unauthorized access to critical data stored within MySQL Connectors, potentially achieving complete access to all accessible data managed by the connector. This level of access could enable data exfiltration, manipulation of sensitive information, or establishment of persistent access points within target networks. Organizations relying on these connectors face significant risks including regulatory compliance violations, financial losses, and reputational damage from potential data breaches.
Mitigation strategies should prioritize immediate patching of affected versions to address the underlying authentication or access control flaws. System administrators must implement network segmentation controls to limit unnecessary exposure of MySQL Connectors to external networks. Additional protective measures include implementing robust monitoring for unusual connection patterns or unauthorized access attempts, enforcing strong authentication mechanisms, and regularly auditing access logs for suspicious activities. Organizations should also consider implementing database activity monitoring solutions that can detect anomalous behavior indicative of exploitation attempts. The CVSS 3.1 score of 7.7 reflects the high severity impact with confidentiality as the primary concern while maintaining a medium complexity attack vector that makes this vulnerability particularly dangerous in production environments where minimal access controls might exist.