CVE-2026-60145 Overview
CVE-2026-60145 is a denial of service vulnerability in the Optimizer component of Oracle MySQL Server and MySQL Cluster. The flaw allows a high-privileged attacker with network access via multiple protocols to trigger a hang or a repeatable crash of the database service. Affected releases include MySQL Server versions 8.4.0 through 8.4.10 and 9.7.0 through 9.7.1, plus MySQL Cluster versions 8.0.0 through 8.0.47, 8.4.0 through 8.4.10, and 9.7.0 through 9.7.1. Oracle disclosed the issue in the July 2026 Critical Patch Update. The vulnerability is classified under [CWE-284: Improper Access Control].
Critical Impact
Successful exploitation causes a complete denial of service against MySQL Server and MySQL Cluster instances, disrupting dependent applications and services.
Affected Products
- Oracle MySQL Server versions 8.4.0 to 8.4.10 and 9.7.0 to 9.7.1
- Oracle MySQL Cluster versions 8.0.0 to 8.0.47
- Oracle MySQL Cluster versions 8.4.0 to 8.4.10 and 9.7.0 to 9.7.1
Discovery Timeline
- 2026-07-21 - CVE-2026-60145 published to NVD
- 2026-07-23 - Last updated in NVD database
Technical Details for CVE-2026-60145
Vulnerability Analysis
The vulnerability resides in the MySQL Optimizer, the component responsible for planning query execution. An authenticated attacker with high privileges can submit crafted input over supported network protocols to cause the server to hang or crash repeatedly. Exploitation impacts availability only. Confidentiality and integrity of data are not affected. The Exploit Prediction Scoring System (EPSS) currently rates the likelihood of exploitation in the wild as low, and no public proof of concept is available at this time.
Root Cause
The issue maps to [CWE-284: Improper Access Control] within the Optimizer subsystem. Oracle has not disclosed the specific code path, but the classification indicates that access control checks are insufficient to prevent a privileged user from invoking an operation that destabilizes the server. The Optimizer either enters an unrecoverable state or dereferences a resource that leads to process termination.
Attack Vector
The attacker requires network reachability to the MySQL service and authenticated credentials with elevated privileges. Exploitation does not require user interaction. Because MySQL exposes multiple protocols including the classic MySQL protocol and X Protocol, several network paths can carry the malicious request. The attacker sends the crafted query or command, and the server hangs or crashes. Restarting the service restores functionality until the request is replayed.
No verified public exploit code is available. Refer to the Oracle Security Alert July 2026 for vendor-provided technical context.
Detection Methods for CVE-2026-60145
Indicators of Compromise
- Unexpected mysqld process crashes or restarts logged in the operating system journal or MySQL error log
- Repeated client disconnects and stalled connections from a specific authenticated account
- Sudden spikes in query planning time followed by service unavailability
Detection Strategies
- Monitor the MySQL error log for signal 11, assertion failures, or Optimizer-related stack traces preceding restarts
- Correlate authentication events for high-privileged accounts with subsequent service outages
- Alert on any deviation from baseline availability metrics for MySQL Server and Cluster nodes
Monitoring Recommendations
- Ingest MySQL error logs, audit logs, and system logs into a centralized SIEM for correlation
- Track Uptime and Aborted_clients status variables and alert on abnormal changes
- Review privileged account usage regularly and flag interactive sessions from unexpected sources
How to Mitigate CVE-2026-60145
Immediate Actions Required
- Apply the July 2026 Oracle Critical Patch Update to all affected MySQL Server and MySQL Cluster instances
- Audit accounts holding administrative or high-privileged database roles and remove unnecessary grants
- Restrict network exposure of MySQL services to trusted application hosts and management networks
Patch Information
Oracle addressed CVE-2026-60145 in the July 2026 Critical Patch Update. Administrators should upgrade to a fixed release beyond MySQL Server 8.4.10 and 9.7.1, and beyond MySQL Cluster 8.0.47, 8.4.10, and 9.7.1. Consult the Oracle Security Alert July 2026 for exact fixed-version numbers and platform-specific packages.
Workarounds
- Enforce least privilege by revoking administrative roles from application service accounts
- Place MySQL behind a bastion or jump host and block direct network access from user workstations
- Enable MySQL audit logging to record privileged activity and support incident review if a crash occurs
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
