CVE-2026-60194: MySQL Server DoS Vulnerability

CVE-2026-60194 Overview

CVE-2026-60194 is a denial of service vulnerability affecting Oracle MySQL Server and MySQL Cluster. The flaw resides in the Server: JSON Duality component and impacts versions 9.7.0 through 9.7.1 of both products. An authenticated attacker with high privileges and network access can trigger a hang or repeatable crash, resulting in complete availability loss. The vulnerability is classified under CWE-284: Improper Access Control. Oracle disclosed the issue in the July 2026 Critical Patch Update.

Critical Impact
Successful exploitation causes a complete denial of service against MySQL Server and MySQL Cluster instances, disrupting database-dependent applications and services.

Affected Products

Oracle MySQL Server versions 9.7.0 through 9.7.1
Oracle MySQL Cluster versions 9.7.0 through 9.7.1
Deployments exposing the JSON Duality component over supported network protocols

Discovery Timeline

2026-07-21 - CVE-2026-60194 published to NVD
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-60194

Vulnerability Analysis

The vulnerability exists within the JSON Duality component of MySQL Server and MySQL Cluster. JSON Duality provides a relational and document-oriented view over the same underlying data, allowing applications to query and modify records through either interface. Improper access control handling in this component allows a high-privileged attacker to submit crafted requests that cause the server process to hang or crash repeatedly. Because the flaw affects availability rather than confidentiality or integrity, data is not directly exposed. However, repeated exploitation renders the database instance unresponsive.

The attacker requires valid credentials with elevated privileges, which limits the pool of viable actors to insiders, compromised service accounts, or attackers who have already achieved a foothold. Exploitation is described by Oracle as easily performed once those preconditions are met.

Root Cause

The issue maps to CWE-284: Improper Access Control. Enforcement gaps within the JSON Duality component permit privileged operations that place the server into an unrecoverable state. Oracle has not published a detailed root cause analysis beyond the advisory summary.

Attack Vector

Exploitation occurs over the network through multiple protocols supported by MySQL Server and MySQL Cluster. The attacker authenticates with a high-privileged account, then issues requests targeting the JSON Duality interface. No user interaction is required, and attack complexity is low. Public proof-of-concept code is not available at the time of publication, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The current EPSS score is 0.422%.

No verified exploit code is available. See the Oracle Security Alert July 2026 for vendor technical details.

Detection Methods for CVE-2026-60194

Indicators of Compromise

Unexpected mysqld process crashes, restarts, or hangs correlated with authenticated sessions using JSON Duality features
Repeated abnormal termination signals in MySQL error logs following queries against duality views
Sudden availability loss on MySQL Cluster nodes coinciding with privileged user activity

Detection Strategies

Monitor MySQL error logs and system logs for repeated mysqld crash signatures and unclean shutdowns
Enable the MySQL Enterprise Audit plugin or general query log to track high-privileged sessions interacting with JSON Duality objects
Baseline normal query patterns against duality views and alert on anomalous request volumes or malformed statements

Monitoring Recommendations

Alert on repeated database service restarts within short intervals across production instances
Track authentication events for accounts holding administrative privileges and correlate with server availability metrics
Forward MySQL logs to a centralized SIEM or data lake for cross-instance correlation and long-term retention

How to Mitigate CVE-2026-60194

Immediate Actions Required

Apply the fixes contained in the Oracle Critical Patch Update July 2026 to all MySQL Server and MySQL Cluster 9.7.x deployments
Audit and reduce the number of accounts holding high-level privileges such as SUPER, SYSTEM_VARIABLES_ADMIN, or schema-level administrative roles
Restrict network access to MySQL listeners so that only trusted application hosts and administrators can reach the service

Patch Information

Oracle published the fix as part of the July 2026 Critical Patch Update. Administrators should upgrade MySQL Server and MySQL Cluster to a version later than 9.7.1 that includes the patch. Refer to the Oracle Security Alert July 2026 for the full patch matrix and installation guidance.

Workarounds

Disable or restrict use of JSON Duality views until patches are applied where the feature is not required
Enforce network segmentation and firewall rules that limit MySQL protocol access to known administrative sources
Rotate credentials for high-privileged database accounts and require multi-factor authentication for administrative access paths

bash

# Configuration example: restrict privileged access and MySQL exposure
# Revoke unnecessary high-level privileges
mysql> REVOKE SUPER, SYSTEM_VARIABLES_ADMIN ON *.* FROM 'app_user'@'%';

# Limit MySQL listener to trusted management network
# /etc/mysql/my.cnf
[mysqld]
bind-address = 10.0.10.25

# Firewall example (iptables) restricting port 3306 to admin subnet
iptables -A INPUT -p tcp --dport 3306 -s 10.0.10.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 3306 -j DROP