CVE-2026-60585: MySQL Server Privilege Escalation Flaw

CVE-2026-60585 Overview

CVE-2026-60585 affects the Replication component of Oracle MySQL Server and MySQL Cluster. The flaw allows a high-privileged attacker with network access via multiple protocols to compromise the affected database instances. Successful exploitation results in complete takeover of MySQL Server and MySQL Cluster deployments, impacting confidentiality, integrity, and availability. Oracle addressed the issue in the July 2026 Critical Patch Update.

Exploitation requires elevated privileges and is difficult to execute, but the impact reaches the full CIA triad. Administrators managing replication topologies should prioritize patching to prevent lateral compromise across primary and replica nodes.

Critical Impact
Successful exploitation leads to full takeover of MySQL Server and MySQL Cluster instances, impacting data confidentiality, integrity, and availability.

Affected Products

MySQL Server versions 8.4.0 through 8.4.10 and 9.7.0 through 9.7.1
MySQL Cluster versions 8.0.0 through 8.0.47
MySQL Cluster versions 8.4.0 through 8.4.10 and 9.7.0 through 9.7.1

Discovery Timeline

2026-07-21 - CVE-2026-60585 published to the National Vulnerability Database
2026-07-21 - Oracle disclosed the issue in the July 2026 Critical Patch Update
2026-07-21 - Last updated in NVD database

Technical Details for CVE-2026-60585

Vulnerability Analysis

The vulnerability resides in the Replication component of MySQL Server and MySQL Cluster. Replication handles the transfer of binary log events between primary and replica nodes. A defect in how the component processes replication traffic allows a high-privileged attacker to escalate control over the database engine.

Oracle classifies the flaw as difficult to exploit, meaning specific conditions or timing must be met. However, once achieved, the attacker gains full control of the database process. This includes reading arbitrary data, modifying stored records, and disrupting service continuity across replicated nodes.

Because replication traffic often crosses trust boundaries between database tiers, an attacker with credentials on one node can pivot to compromise peers. This makes clustered production deployments particularly exposed to cascading takeover.

Root Cause

Oracle has not disclosed the specific technical root cause. Based on the affected component, the defect involves improper handling of replication protocol messages or replication metadata. Oracle Critical Patch Update advisories typically withhold implementation-level details until patches are broadly deployed.

Attack Vector

An attacker must hold high privileges within the MySQL environment and reach the target over the network using one of multiple supported protocols. The attacker leverages authenticated access to inject or manipulate replication traffic, ultimately achieving control of the server process. No user interaction is required.

Exploitation code is not publicly available and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Refer to the Oracle Critical Patch Update July 2026 advisory for vendor-supplied technical context.

Detection Methods for CVE-2026-60585

Indicators of Compromise

Unexpected replication user logins from unusual source addresses or at atypical times
Malformed or truncated binary log events recorded on replica nodes
Unauthorized changes to mysql.user, mysql.gtid_executed, or replication filter configuration
Sudden restart or crash of mysqld processes on primary or replica nodes

Detection Strategies

Audit all accounts holding REPLICATION SLAVE, REPLICATION CLIENT, and SUPER privileges and flag additions
Correlate authentication logs with replication channel connection events to identify anomalous sessions
Compare running MySQL Server and Cluster versions against the fixed builds published in the Oracle July 2026 CPU

Monitoring Recommendations

Forward MySQL general query, error, and audit logs to a centralized SIEM for correlation
Enable the MySQL Enterprise Audit plugin or an equivalent to capture privileged statement execution
Alert on modifications to replication topology, including CHANGE MASTER TO and CHANGE REPLICATION SOURCE TO statements

How to Mitigate CVE-2026-60585

Immediate Actions Required

Apply the Oracle July 2026 Critical Patch Update to all MySQL Server and MySQL Cluster nodes
Inventory database accounts and revoke administrative or replication privileges from accounts that do not require them
Restrict network access to MySQL replication ports so that only known primary and replica hosts can connect
Rotate credentials for any account with SUPER or replication privileges following the patch

Patch Information

Oracle released fixes as part of the July 2026 Critical Patch Update. Upgrade MySQL Server to a version later than 8.4.10 or 9.7.1 as specified in the advisory. Upgrade MySQL Cluster beyond 8.0.47, 8.4.10, or 9.7.1 respectively. Full patch details are available in the Oracle Critical Patch Update July 2026 advisory.

Workarounds

Enforce network segmentation and firewall rules that restrict replication traffic to known hosts
Require TLS for all replication channels and validate certificates on both endpoints
Reduce the number of accounts granted high-privilege roles and apply least privilege to replication users
Monitor for unauthorized CHANGE MASTER or CHANGE REPLICATION SOURCE statements and alert on execution

bash

# Configuration example: enforce TLS on replication channels
CHANGE REPLICATION SOURCE TO
  SOURCE_HOST='primary.internal',
  SOURCE_USER='repl_user',
  SOURCE_SSL=1,
  SOURCE_SSL_CA='/etc/mysql/ssl/ca.pem',
  SOURCE_SSL_VERIFY_SERVER_CERT=1;

# Restrict replication port at the host firewall
iptables -A INPUT -p tcp --dport 3306 -s <replica_ip> -j ACCEPT
iptables -A INPUT -p tcp --dport 3306 -j DROP