CVE-2026-60315: MySQL Server X Plugin DoS Vulnerability

CVE-2026-60315 Overview

CVE-2026-60315 is a high-severity vulnerability in the Oracle MySQL Server and MySQL Cluster products, specifically within the X Plugin component. The flaw allows an unauthenticated attacker with network access to compromise MySQL Server and MySQL Cluster instances via multiple protocols. Successful exploitation results in a complete denial of service (hang or repeatable crash) and unauthorized read access to a subset of database data. Oracle disclosed this issue in the July 2026 Critical Patch Update.

Critical Impact
Remote, unauthenticated attackers can crash MySQL Server or MySQL Cluster processes and read a subset of accessible database data over the network.

Affected Products

MySQL Server versions 8.4.0 through 8.4.10 and 9.7.0 through 9.7.1
MySQL Cluster versions 8.0.0 through 8.0.47
MySQL Cluster versions 8.4.0 through 8.4.10 and 9.7.0 through 9.7.1

Discovery Timeline

2026-07-21 - CVE-2026-60315 published to NVD following Oracle's July 2026 Critical Patch Update
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-60315

Vulnerability Analysis

The vulnerability resides in the MySQL X Plugin, which implements the X Protocol used by MySQL Shell and X DevAPI clients. The X Plugin typically listens on TCP port 33060 and handles protocol buffer-based communication for CRUD, SQL, and administrative operations. A flaw in how the plugin processes network input allows an unauthenticated remote attacker to trigger a hang or repeatable crash, producing a complete denial of service. The same code path also permits unauthorized read access to a subset of data accessible to the server process.

The attack requires no authentication, no user interaction, and only network reachability to the X Plugin listener. Oracle characterizes the vulnerability as easily exploitable, and it is exposed through multiple protocols supported by the X Plugin.

Root Cause

Oracle has not published detailed root-cause information for this issue. Based on the impact profile (crash plus partial confidentiality loss without integrity impact), the defect is consistent with improper input validation in the X Protocol parser, resulting in Denial of Service and Information Disclosure conditions triggered by malformed protocol messages. Refer to the Oracle Security Alert July 2026 for authoritative details.

Attack Vector

An attacker sends crafted X Protocol traffic to an exposed MySQL X Plugin endpoint. Because the vulnerability is pre-authentication, any network-reachable MySQL Server or Cluster instance running the X Plugin on the affected versions is exposed. Repeated exploitation can keep the database unavailable, and probing the same code path can leak a subset of server-accessible data. The EPSS score is 0.244% as of 2026-07-23, indicating limited observed exploitation activity at publication time.

No public proof-of-concept code is available. Describing a synthetic exploit would be speculative; consult the Oracle advisory for the definitive technical description.

Detection Methods for CVE-2026-60315

Indicators of Compromise

Unexpected MySQL Server or mysqld process crashes or hangs with restart loops, particularly correlated with inbound traffic on TCP 33060.
Anomalous volumes of X Protocol connections from unfamiliar source IPs to MySQL hosts.
MySQL error log entries referencing X Plugin protocol parsing errors or abrupt session terminations.

Detection Strategies

Monitor MySQL error logs (log_error) and performance_schema for repeated X Plugin session failures and abnormal disconnects.
Deploy network signatures on IDS/IPS to flag malformed X Protocol messages targeting port 33060.
Correlate database process restarts with preceding network activity to the X Plugin listener.

Monitoring Recommendations

Alert on MySQL service availability drops and automatic restarts on affected versions.
Track authentication failures and connection anomalies on the X Protocol port from external or non-application sources.
Baseline normal X Protocol client sources and alert on deviations.

How to Mitigate CVE-2026-60315

Immediate Actions Required

Apply the July 2026 Oracle Critical Patch Update to all affected MySQL Server and MySQL Cluster deployments.
Restrict network access to the X Plugin port (33060 by default) to trusted application hosts using firewalls or security groups.
Inventory MySQL Server and Cluster instances to identify any running affected versions 8.0.0-8.0.47, 8.4.0-8.4.10, or 9.7.0-9.7.1.

Patch Information

Oracle addressed CVE-2026-60315 in the July 2026 Critical Patch Update. Administrators should upgrade to the fixed releases identified in the Oracle Security Alert July 2026. MySQL Cluster 8.0.x users must move to the patched 8.0 release, and 8.4.x and 9.7.x users must move to the corresponding fixed maintenance releases.

Workarounds

Disable the X Plugin where it is not required by setting mysqlx=OFF in my.cnf and restarting the server.
Bind the X Plugin to localhost using mysqlx_bind_address=127.0.0.1 if only local clients require access.
Enforce network segmentation and allow-list source IPs permitted to reach TCP 33060 until patching is complete.

bash

# Disable the X Plugin in my.cnf to remove exposure until patched
[mysqld]
mysqlx=OFF

# Or restrict the X Plugin listener to loopback only
[mysqld]
mysqlx_bind_address=127.0.0.1
mysqlx_port=33060