CVE-2026-60188 Overview
CVE-2026-60188 is a denial-of-service vulnerability in the Replication component of Oracle MySQL Server and MySQL Cluster. A high-privileged attacker with network access via multiple protocols can trigger a hang or repeatable crash, producing a complete denial of service. The flaw affects MySQL Server versions 8.4.0-8.4.10 and 9.7.0-9.7.1, along with MySQL Cluster versions 8.0.0-8.0.47, 8.4.0-8.4.10, and 9.7.0-9.7.1. Oracle addressed the issue in the July 2026 Critical Patch Update. The weakness maps to [CWE-284] (Improper Access Control).
Critical Impact
Successful exploitation results in a complete denial of service through server hang or repeatable crash of MySQL Server and MySQL Cluster instances.
Affected Products
- Oracle MySQL Server versions 8.4.0 through 8.4.10 and 9.7.0 through 9.7.1
- Oracle MySQL Cluster versions 8.0.0 through 8.0.47
- Oracle MySQL Cluster versions 8.4.0 through 8.4.10 and 9.7.0 through 9.7.1
Discovery Timeline
- 2026-07-21 - CVE-2026-60188 published to NVD
- 2026-07-23 - Last updated in NVD database
Technical Details for CVE-2026-60188
Vulnerability Analysis
The vulnerability resides in the Server: Replication component of Oracle MySQL. An authenticated attacker holding elevated database privileges can send crafted input over multiple supported protocols to disrupt the replication subsystem. Exploitation causes the database process to hang or crash repeatably, halting query processing across replicating nodes.
The issue is classified as difficult to exploit because it depends on precise conditions and existing high-privilege access. However, MySQL Cluster deployments face amplified risk because the crash propagates through replication topology and can degrade availability for downstream replicas. The EPSS score is 0.262% with a percentile of 17.875, indicating low near-term exploitation probability.
Root Cause
The defect stems from improper access control [CWE-284] within the replication code path. Oracle has not released implementation-level details, but the impact profile confirms the flaw allows a privileged actor to reach a code path that terminates or stalls the server process. Only availability is affected — confidentiality and integrity remain intact.
Attack Vector
An attacker requires network reachability to the MySQL Server or MySQL Cluster instance and valid high-privilege credentials such as REPLICATION SLAVE, SUPER, or equivalent administrative rights. The attack traverses multiple supported protocols, meaning the classic MySQL client protocol as well as X Protocol interfaces can be leveraged. No user interaction is required to trigger the fault once the attacker submits the malformed input.
See the Oracle Security Alert July 2026 for the authoritative advisory and version matrix.
Detection Methods for CVE-2026-60188
Indicators of Compromise
- Unexpected mysqld process crashes or restarts logged in error.log referencing replication threads
- Replication I/O or SQL threads terminating with fatal errors and failing to resume
- Sudden availability loss on primary or replica nodes correlated with administrative logins
Detection Strategies
- Monitor MySQL error logs for repeated segmentation faults and assertion failures in replication code paths
- Alert on SHOW REPLICA STATUS or SHOW SLAVE STATUS outputs reporting Slave_SQL_Running=No following administrative sessions
- Correlate authentication events for accounts with REPLICATION or SUPER privileges against subsequent crash events
Monitoring Recommendations
- Track the performance_schema.replication_applier_status table for abnormal thread termination
- Enable audit logging for high-privilege accounts and review commands preceding server restarts
- Baseline replication lag and process uptime to detect deviations that indicate abuse attempts
How to Mitigate CVE-2026-60188
Immediate Actions Required
- Apply the Oracle July 2026 Critical Patch Update to all affected MySQL Server and MySQL Cluster deployments
- Audit and reduce the number of accounts holding SUPER, REPLICATION SLAVE, or equivalent privileges
- Restrict network access to MySQL listener ports so that only trusted replication peers and administrators can connect
Patch Information
Oracle published the fix in the July 2026 Critical Patch Update. Upgrade MySQL Server to a version later than 8.4.10 or 9.7.1, and upgrade MySQL Cluster beyond 8.0.47, 8.4.10, or 9.7.1 as applicable. Consult the Oracle Security Alert July 2026 for exact fixed versions.
Workarounds
- Enforce network segmentation and firewall rules limiting MySQL access to known application and replication hosts
- Rotate credentials for privileged accounts and enable multi-factor authentication on jump hosts used for database administration
- Enable comprehensive audit logging and alerting on privileged database sessions until patching is complete
# Restrict MySQL access to trusted replication peers using host-based firewall
sudo iptables -A INPUT -p tcp --dport 3306 -s 10.0.0.0/24 -j ACCEPT
sudo iptables -A INPUT -p tcp --dport 3306 -j DROP
# Review privileged accounts that could exploit the replication component
mysql -u root -p -e "SELECT user, host FROM mysql.user WHERE Super_priv='Y' OR Repl_slave_priv='Y';"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
