CVE-2026-60586: MySQL Connector/J Info Disclosure Flaw

CVE-2026-60586 Overview

CVE-2026-60586 is a high-severity vulnerability in the Oracle MySQL Connectors product, specifically affecting the Connector/J component. Supported versions 9.7.0 through 9.7.1 are affected. A low-privileged attacker with network access via multiple protocols can exploit this flaw to compromise MySQL Connectors. The vulnerability carries a scope change, meaning successful exploitation can significantly impact additional components beyond the Connector itself. Oracle disclosed the issue in the July 2026 Critical Patch Update.

Critical Impact
Successful exploitation results in unauthorized access to critical data or complete access to all MySQL Connectors accessible data, with impact extending beyond the vulnerable component due to a security scope change.

Affected Products

Oracle MySQL Connectors 9.7.0
Oracle MySQL Connectors 9.7.1
Component: Connector/J

Discovery Timeline

2026-07-21 - CVE-2026-60586 published to NVD
2026-07-21 - Last updated in NVD database
July 2026 - Oracle publishes Critical Patch Update advisory (Oracle Security Alert July 2026)

Technical Details for CVE-2026-60586

Vulnerability Analysis

The vulnerability resides in Oracle MySQL Connector/J, the official Java Database Connectivity (JDBC) driver for MySQL. Connector/J enables Java applications to communicate with MySQL database servers. The flaw allows a network-based attacker holding low privileges to bypass intended trust boundaries when interacting with the driver.

Because the CVSS vector indicates a scope change (S:C), the attacker's actions in the vulnerable Connector component can affect resources managed by a different security authority. In practice, this means downstream Java applications relying on Connector/J may leak or expose sensitive database information beyond what the connector itself controls.

The impact is limited to confidentiality (C:H), with no direct integrity or availability degradation. However, unauthorized access to database credentials, query results, or session data can enable follow-on attacks against the broader application stack.

Root Cause

Oracle has not published detailed technical root-cause information for CVE-2026-60586. The advisory categorizes it as a network-exploitable confidentiality flaw in Connector/J that requires only low privileges and no user interaction. See the Oracle Security Alert July 2026 for vendor guidance.

Attack Vector

The attack vector is Network (AV:N). An authenticated attacker with limited privileges can reach the vulnerable Connector/J code path over multiple protocols supported by MySQL Connectors. Attack complexity is low (AC:L), and no user interaction is required (UI:N). Because scope changes to a different security context, the attacker can influence data outside the immediate connector boundary.

No verified proof-of-concept code is publicly available. The EPSS probability is approximately 0.355% (28th percentile) as of 2026-07-23, indicating a low current likelihood of observed exploitation.

Detection Methods for CVE-2026-60586

Indicators of Compromise

Unexpected outbound traffic from Java application servers to unknown MySQL endpoints or ports.
Anomalous query patterns or bulk data reads originating from application service accounts using Connector/J.
Presence of vulnerable mysql-connector-j JAR versions 9.7.0 or 9.7.1 in application classpaths or dependency manifests.

Detection Strategies

Inventory Java application dependencies using software composition analysis (SCA) tools to identify Connector/J 9.7.0 and 9.7.1.
Enable MySQL general query log and audit plugin to capture connection metadata, authenticated user, and executed statements.
Correlate application logs with database session logs to identify sessions accessing data outside expected business logic scope.

Monitoring Recommendations

Monitor MySQL server logs for repeated authentication attempts from low-privileged accounts followed by unusual data reads.
Track network flows between application tiers and MySQL instances for volumetric anomalies suggesting data exfiltration.
Alert on runtime loading of mysql-connector-j-9.7.0.jar or mysql-connector-j-9.7.1.jar in production JVMs.

How to Mitigate CVE-2026-60586

Immediate Actions Required

Identify all Java applications using Oracle MySQL Connector/J versions 9.7.0 or 9.7.1.
Apply the fixed Connector/J release referenced in the July 2026 Oracle Critical Patch Update.
Rotate MySQL account credentials used by applications that loaded the vulnerable driver, particularly low-privileged service accounts.
Restrict network reachability of MySQL endpoints to only required application hosts.

Patch Information

Oracle addressed CVE-2026-60586 in the July 2026 Critical Patch Update. Administrators should upgrade Connector/J beyond 9.7.1 using the fixed version listed in the Oracle Security Alert July 2026. Redeploy affected Java applications with the patched driver and confirm the update via dependency manifests.

Workarounds

Enforce least privilege on all MySQL accounts used by Connector/J clients to limit data accessible in the event of exploitation.
Place MySQL servers behind network segmentation so only authorized application subnets can initiate connections.
Require TLS for all client-to-server MySQL communication to reduce exposure across untrusted network paths.

bash

# Verify Connector/J version in a Maven project and upgrade past 9.7.1
mvn dependency:tree | grep mysql-connector-j

# Example Maven coordinate update (replace VERSION with the fixed release)
# <dependency>
#   <groupId>com.mysql</groupId>
#   <artifactId>mysql-connector-j</artifactId>
#   <version>VERSION</version>
# </dependency>

# Restrict MySQL account privileges as a defense-in-depth measure
mysql -u root -p -e "REVOKE ALL PRIVILEGES ON *.* FROM 'app_user'@'%'; \
GRANT SELECT, INSERT, UPDATE ON app_db.* TO 'app_user'@'10.0.0.0/24'; \
FLUSH PRIVILEGES;"