CVE-2026-60623: MySQL Connector/J Auth Bypass Vulnerability

CVE-2026-60623 Overview

CVE-2026-60623 is a high-severity vulnerability affecting the MySQL Connectors product of Oracle MySQL, specifically the Connector/J component. Supported versions 9.7.0 through 9.7.1 are affected. A low-privileged attacker with network access via multiple protocols can compromise MySQL Connectors, though successful exploitation is considered difficult. The vulnerability affects confidentiality, integrity, and availability of the connector and its accessible data. Oracle disclosed this issue in the July 2026 Critical Patch Update.

Critical Impact
Successful exploitation allows unauthorized creation, deletion, or modification of all MySQL Connectors accessible data, complete read access to that data, and a partial denial of service condition.

Affected Products

Oracle MySQL Connectors (Connector/J) version 9.7.0
Oracle MySQL Connectors (Connector/J) version 9.7.1
Applications embedding the affected Connector/J JDBC driver

Discovery Timeline

2026-07-21 - CVE-2026-60623 published to the National Vulnerability Database (NVD)
2026-07-21 - Oracle publishes the Oracle Security Alert July 2026 addressing the flaw
2026-07-21 - Last updated in NVD database

Technical Details for CVE-2026-60623

Vulnerability Analysis

The flaw resides in Oracle MySQL Connector/J, the official Java Database Connectivity (JDBC) driver used by Java applications to communicate with MySQL servers. An authenticated but low-privileged attacker can reach the vulnerable code paths over the network using multiple supported protocols. Exploitation requires no user interaction. Oracle classifies the attack complexity as high, indicating that specific conditions outside the attacker's direct control must be satisfied for a reliable exploit. When those conditions are met, the attacker gains full read and write access to all data accessible to the connector and can cause a partial denial of service against the connector process.

Root Cause

Oracle has not published detailed root-cause information for CVE-2026-60623. The advisory identifies the affected component as Connector/J and confirms impact to confidentiality, integrity, and availability. Because Connector/J parses server responses, handles authentication handshakes, and processes query result sets on behalf of Java clients, flaws in this component typically arise from improper input validation, unsafe deserialization, or mishandled protocol state. Consult the Oracle Security Alert July 2026 for authoritative technical details as Oracle releases them.

Attack Vector

The attack vector is network-based. An attacker with low privileges and network reachability to a system using an affected Connector/J version can trigger the vulnerability through supported MySQL protocols. No local access or user interaction is required. Typical exposure scenarios include Java application servers, middleware, ETL jobs, and reporting services that connect to MySQL or compatible databases using the affected driver. A malicious or compromised database endpoint interacting with a client using Connector/J is a realistic exploitation pathway.

No public proof-of-concept exploit is currently available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The current EPSS probability is 0.244%.

Detection Methods for CVE-2026-60623

Indicators of Compromise

Unexpected JDBC connections from application servers to unknown or untrusted MySQL endpoints
Anomalous read or write volume from Java application processes using Connector/J
Java process crashes or repeated exceptions originating from com.mysql.cj.* packages
Outbound MySQL protocol traffic (TCP/3306) to hosts outside the approved database inventory

Detection Strategies

Inventory all Java applications and identify the Connector/J version in use, flagging any at 9.7.0 or 9.7.1
Monitor JDBC driver logs for parser errors, malformed packet warnings, and unexpected disconnects
Alert on privileged data modifications originating from service accounts tied to Java applications
Correlate database audit logs with application-tier telemetry to identify unauthorized reads or writes

Monitoring Recommendations

Enable MySQL general and audit logging on all databases accessed by affected connectors
Baseline normal query patterns per application and alert on statistical deviations
Capture JVM stack traces for Connector/J exceptions and forward them to a central logging platform
Restrict and monitor egress from Java application hosts to only approved database IP ranges

How to Mitigate CVE-2026-60623

Immediate Actions Required

Identify every deployment of Connector/J 9.7.0 and 9.7.1 across development, staging, and production
Apply the fixes shipped in the Oracle Security Alert July 2026
Rotate credentials used by Java applications connecting to MySQL if compromise is suspected
Review database audit logs since the affected driver was deployed for unauthorized data changes

Patch Information

Oracle addressed CVE-2026-60623 in the July 2026 Critical Patch Update. Upgrade Connector/J to the fixed release referenced in the Oracle Security Alert July 2026. Rebuild and redeploy Java applications so they load the patched driver, and confirm the updated version is on the classpath at runtime.

Workarounds

Restrict Connector/J clients to trusted MySQL endpoints using network segmentation and firewall allow-lists
Enforce least-privilege database accounts so service users cannot modify data beyond application scope
Require TLS for all MySQL connections and validate server certificates to reduce hostile endpoint exposure
Disable unused MySQL protocol features and authentication plugins where feasible

bash

# Verify the Connector/J version bundled with a Java application
unzip -p app.jar META-INF/MANIFEST.MF | grep -i 'Bundle-Version\|Implementation-Version'

# Enforce TLS and server certificate validation in the JDBC URL
# jdbc:mysql://db.internal:3306/app?useSSL=true&requireSSL=true&verifyServerCertificate=true