CVE-2026-60192: MySQL Connector/Net Auth Bypass Vulnerability

CVE-2026-60192 Overview

CVE-2026-60192 is a high-severity vulnerability in the Oracle MySQL Connectors product, specifically the Connector/Net component. Supported versions 9.7.0 through 9.7.1 are affected. An unauthenticated attacker with network access via multiple protocols can compromise MySQL Connectors. Successful exploitation results in complete takeover of MySQL Connectors, with impacts to confidentiality, integrity, and availability. The weakness is categorized under [CWE-284] Improper Access Control. Oracle addressed the issue in the July 2026 Critical Patch Update.

Critical Impact
Successful exploitation allows a remote, unauthenticated attacker to fully take over MySQL Connectors, compromising confidentiality, integrity, and availability of applications using Connector/Net.

Affected Products

Oracle MySQL Connectors Connector/Net version 9.7.0
Oracle MySQL Connectors Connector/Net version 9.7.1
Applications embedding the affected Connector/Net library

Discovery Timeline

2026-07-21 - CVE CVE-2026-60192 published to NVD
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-60192

Vulnerability Analysis

The vulnerability resides in Oracle MySQL Connector/Net, the ADO.NET driver used by .NET applications to connect to MySQL servers. The flaw is classified as an Improper Access Control weakness [CWE-284]. An attacker does not need authentication, credentials, or user interaction to exploit the issue. The attacker leverages network access across multiple protocols supported by the connector to reach vulnerable code paths. Exploitation is rated as difficult, indicating specific conditions such as timing, configuration, or protocol interaction must be met. When those conditions are satisfied, the connector is fully compromised, giving the attacker control over its operations and any data it processes.

Root Cause

The root cause is improper enforcement of access control within the Connector/Net component when handling network-supplied input across multiple supported protocols. The connector fails to adequately restrict actions that should require validation or authentication, allowing an unauthenticated network attacker to influence connector behavior. Oracle has not published low-level technical details of the flaw, but the CWE-284 classification identifies missing or incorrect access enforcement as the underlying defect.

Attack Vector

The attack vector is Network. An attacker positioned to communicate with the vulnerable Connector/Net instance, or to influence traffic it processes, can trigger the flaw without credentials. Because the connector runs inside client applications, exposure depends on how those applications expose or consume connector traffic on the network. Successful exploitation results in a scope-unchanged compromise with high confidentiality, integrity, and availability impact.

No public proof-of-concept code has been released. Refer to the Oracle Critical Patch Update July 2026 advisory for vendor-supplied technical details.

Detection Methods for CVE-2026-60192

Indicators of Compromise

Unexpected outbound or inbound connections associated with .NET processes that link against MySql.Data.dll or the newer MySql.Data NuGet package.
Anomalous MySQL protocol traffic patterns, including malformed handshake packets or unusual authentication plugin negotiation.
Crashes, memory anomalies, or unexpected privilege changes in host processes that embed Connector/Net.

Detection Strategies

Inventory all .NET applications that reference MySql.Data versions 9.7.0 or 9.7.1 and flag them as vulnerable until patched.
Deploy network monitoring on segments carrying MySQL traffic to detect protocol anomalies against expected client behavior.
Correlate application crash telemetry with concurrent inbound network activity to identify possible exploitation attempts.

Monitoring Recommendations

Enable process and network telemetry on hosts running affected .NET applications to capture connector-related activity.
Alert on unusual child process creation or file writes originating from applications that host Connector/Net.
Monitor for outbound connections from application hosts to unexpected external endpoints following MySQL protocol exchanges.

How to Mitigate CVE-2026-60192

Immediate Actions Required

Apply the Oracle July 2026 Critical Patch Update to all instances of MySQL Connector/Net versions 9.7.0 and 9.7.1.
Identify every application dependency on MySql.Data 9.7.0-9.7.1 across build pipelines, container images, and deployed hosts.
Restrict network reachability of applications embedding the vulnerable connector to trusted database peers only.

Patch Information

Oracle released fixes for this vulnerability as part of the Oracle Critical Patch Update July 2026. Upgrade Connector/Net to the fixed version published in that advisory. Rebuild and redeploy any applications that statically bundle the affected MySql.Data assembly.

Workarounds

Place affected applications behind network segmentation that permits only vetted MySQL server endpoints to communicate with the connector.
Terminate MySQL client sessions through a controlled proxy or firewall that enforces protocol conformance until patching is complete.
Reduce exposure by disabling protocol options in Connector/Net configuration that are not required by the application.

bash

# Example: identify vulnerable Connector/Net assemblies on a Windows host
Get-ChildItem -Path C:\ -Recurse -Filter MySql.Data.dll -ErrorAction SilentlyContinue |
  ForEach-Object { [PSCustomObject]@{ Path = $_.FullName; Version = $_.VersionInfo.FileVersion } } |
  Where-Object { $_.Version -like '9.7.0*' -or $_.Version -like '9.7.1*' }