CVE-2026-60190 Overview
CVE-2026-60190 is a low-severity denial of service vulnerability in the Replication component of Oracle MySQL Server and MySQL Cluster. The flaw allows a high-privileged attacker with network access via multiple protocols to cause a partial denial of service. Affected versions include MySQL Server 8.4.0-8.4.10 and 9.7.0-9.7.1, along with MySQL Cluster 8.0.0-8.0.47, 8.4.0-8.4.10, and 9.7.0-9.7.1. Oracle addressed the issue in the July 2026 Critical Patch Update. The vulnerability maps to [CWE-284] Improper Access Control.
Critical Impact
Successful exploitation results in a partial availability impact on MySQL Server and MySQL Cluster instances through the replication subsystem.
Affected Products
- Oracle MySQL Server versions 8.4.0 through 8.4.10 and 9.7.0 through 9.7.1
- Oracle MySQL Cluster versions 8.0.0 through 8.0.47
- Oracle MySQL Cluster versions 8.4.0 through 8.4.10 and 9.7.0 through 9.7.1
Discovery Timeline
- 2026-07-21 - CVE-2026-60190 published to NVD
- 2026-07-23 - Last updated in NVD database
- July 2026 - Oracle releases fix in Critical Patch Update
Technical Details for CVE-2026-60190
Vulnerability Analysis
The vulnerability resides in the Server: Replication component of Oracle MySQL. Replication in MySQL propagates changes from a source server to one or more replica servers through binary log events. Improper access control within this subsystem allows an authenticated attacker holding elevated privileges to disrupt normal replication operation.
The attacker interacts with the server across multiple protocols, meaning both native MySQL protocol connections and administrative channels can serve as entry points. Exploitation is described as difficult, requiring specific conditions or timing to trigger the failure. Impact is limited to a partial denial of service — integrity and confidentiality remain unaffected.
Root Cause
The root cause is classified under [CWE-284] Improper Access Control. The replication subsystem does not sufficiently restrict actions available to high-privileged accounts. This permits abuse that degrades availability of the MySQL Server or MySQL Cluster process handling replication tasks.
Attack Vector
The attack originates from the network and requires the adversary to already hold high privileges on the target instance. No user interaction is required. Because privileged database access is a prerequisite, exploitation scenarios typically involve compromised database administrator accounts, malicious insiders, or lateral movement from another compromised system. Technical details of the exploitation flow are not published; consult the Oracle Critical Patch Update July 2026 advisory for vendor-specific information.
Detection Methods for CVE-2026-60190
Indicators of Compromise
- Unexpected replication thread failures, stalls, or restarts on source or replica nodes
- Repeated errors in the MySQL error log referencing replication I/O or SQL threads
- Abnormal command patterns from high-privileged accounts targeting replication statements such as CHANGE REPLICATION SOURCE, START REPLICA, or STOP REPLICA
Detection Strategies
- Audit privileged account activity against the mysql.slave_master_info and replication status tables for unusual modifications
- Correlate database availability alerts with authenticated sessions from administrative users to identify potential abuse patterns
- Monitor MySQL performance schema and error logs for repeated replication component crashes or restarts
Monitoring Recommendations
- Enable the MySQL Enterprise Audit plugin or equivalent to log all replication-related administrative commands
- Forward MySQL error logs and audit logs to a centralized SIEM for correlation and long-term retention
- Alert on deviations in replication lag, thread state transitions, and privileged session counts
How to Mitigate CVE-2026-60190
Immediate Actions Required
- Apply the July 2026 Oracle Critical Patch Update to all affected MySQL Server and MySQL Cluster deployments
- Review and reduce the number of accounts holding REPLICATION_SLAVE_ADMIN, SUPER, or equivalent high privileges
- Rotate credentials for privileged database accounts and enforce strong authentication controls
Patch Information
Oracle released fixes as part of the July 2026 Critical Patch Update. Administrators should upgrade to a MySQL Server or MySQL Cluster release later than the affected version ranges. Refer to the Oracle Critical Patch Update July 2026 advisory for exact fixed build numbers and download locations.
Workarounds
- Restrict network access to the MySQL service using firewall rules so only trusted management hosts can reach replication ports
- Enforce least privilege by removing replication administration rights from accounts that do not require them
- Isolate replication traffic on a dedicated network segment protected by TLS and mutual authentication
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
