CVE-2026-60195 Overview
CVE-2026-60195 is a denial of service vulnerability in the Oracle MySQL Server and MySQL Cluster products. The flaw resides in the Server: JSON Duality component and affects MySQL Server versions 9.7.0 through 9.7.1 and MySQL Cluster versions 9.7.0 through 9.7.1. An authenticated attacker with high privileges can exploit the vulnerability over the network using multiple protocols. Successful exploitation causes a hang or repeatable crash, producing a complete denial of service condition. The weakness maps to [CWE-284: Improper Access Control].
Critical Impact
Authenticated high-privileged attackers can trigger a complete denial of service against MySQL Server and MySQL Cluster instances over the network.
Affected Products
- Oracle MySQL Server versions 9.7.0 to 9.7.1
- Oracle MySQL Cluster versions 9.7.0 to 9.7.1
- JSON Duality component within Oracle MySQL
Discovery Timeline
- 2026-07-21 - CVE-2026-60195 published to the National Vulnerability Database
- 2026-07-23 - Last updated in NVD database
Technical Details for CVE-2026-60195
Vulnerability Analysis
The vulnerability affects the JSON Duality component of Oracle MySQL Server and MySQL Cluster. JSON Duality provides a bidirectional mapping between relational tables and JSON documents. Improper access control within this component ([CWE-284]) allows an authenticated attacker holding elevated privileges to submit crafted requests that force the database service into a hang or crash state.
The issue affects availability only. Confidentiality and integrity are not impacted according to the published CVSS vector. The attack surface spans multiple network protocols supported by MySQL, expanding the number of viable entry points for exploitation.
The EPSS probability of 0.422% with a percentile of 34.509 indicates limited observed exploit interest at the time of publication. No public proof-of-concept, exploit code, or CISA Known Exploited Vulnerabilities listing exists for this CVE.
Root Cause
The root cause is improper access control within the JSON Duality subsystem. Requests processed by this component are not sufficiently validated against permission or state constraints, permitting a privileged user to induce a fault condition. Oracle has not published deeper implementation details beyond the security alert bulletin.
Attack Vector
Exploitation requires network access, high privileges on the target database, and no user interaction. The attacker sends crafted queries or protocol messages targeting the JSON Duality component. The MySQL Server or MySQL Cluster process then hangs or crashes, halting service for legitimate clients. See the Oracle Security Alert July 2026 for vendor guidance.
Detection Methods for CVE-2026-60195
Indicators of Compromise
- Repeated MySQL Server or MySQL Cluster process crashes or restarts with no legitimate operational cause
- Sustained hangs or unresponsiveness in JSON Duality query handling
- Authenticated sessions from high-privileged accounts issuing anomalous JSON Duality requests
Detection Strategies
- Monitor MySQL error logs for repeated fatal signals, assertion failures, or abrupt shutdowns tied to JSON Duality operations
- Correlate crash events with the source IP and account of the most recent authenticated session
- Alert on unexpected use of JSON Duality features by administrative accounts outside change windows
Monitoring Recommendations
- Enable MySQL general query and audit logging for privileged accounts to capture JSON Duality statements
- Track database process uptime and generate alerts on unplanned restarts
- Baseline JSON Duality workload patterns and alert on statistical outliers
How to Mitigate CVE-2026-60195
Immediate Actions Required
- Apply the Oracle Critical Patch Update from July 2026 to all MySQL Server and MySQL Cluster deployments on 9.7.0 or 9.7.1
- Audit and reduce the number of accounts holding administrative or SUPER-level privileges
- Restrict network access to MySQL listeners to trusted management segments only
Patch Information
Oracle addressed CVE-2026-60195 in the July 2026 Critical Patch Update. Refer to the Oracle Security Alert July 2026 for the specific fixed builds and installation guidance for MySQL Server and MySQL Cluster.
Workarounds
- Revoke unnecessary high-privilege grants from application and service accounts until patching is complete
- Enforce network-level access control lists to permit database traffic only from known application hosts
- Enable connection rate limiting and query timeouts to reduce impact of a hang condition
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
