CVE-2026-60718 Overview
CVE-2026-60718 is a denial-of-service vulnerability in the JSON component of Oracle MySQL Server and MySQL Cluster. The flaw affects MySQL Server versions 9.7.0 through 9.7.1 and MySQL Cluster versions 9.7.0 through 9.7.1. An authenticated attacker with low privileges and network access can exploit the vulnerability through multiple protocols to cause a hang or repeatable crash. Successful exploitation results in a complete denial of service against the database instance. Oracle disclosed the issue in the July 2026 Critical Patch Update.
Critical Impact
Low-privileged remote attackers can trigger a complete denial of service against MySQL Server and MySQL Cluster instances by abusing the JSON component.
Affected Products
- Oracle MySQL Server versions 9.7.0 through 9.7.1
- Oracle MySQL Cluster versions 9.7.0 through 9.7.1
- Server: JSON component
Discovery Timeline
- 2026-07-21 - CVE-2026-60718 published to the National Vulnerability Database
- 2026-07-21 - Last updated in NVD database
- July 2026 - Oracle publishes fix in the Oracle Critical Patch Update Advisory - July 2026
Technical Details for CVE-2026-60718
Vulnerability Analysis
The vulnerability resides in the JSON handling component of MySQL Server and MySQL Cluster. An attacker with an authenticated low-privilege account can send crafted input over one of the supported MySQL network protocols to trigger the flaw. Exploitation causes the server to hang or crash reproducibly, producing a complete availability loss. The issue is scoped to availability only. It does not expose data confidentiality or allow tampering with stored records. Oracle rates the issue as easily exploitable given valid network access and any authenticated session. The EPSS probability is 0.411% with a percentile of 33.566, indicating limited but non-zero public exploitation interest at time of publication.
Root Cause
Oracle has not published the internal defect details. Based on the advisory, the JSON subsystem mishandles specific input patterns during parsing, evaluation, or serialization of JSON values. The mishandling drives the server into an unrecoverable state or worker thread stall. Repeated triggering produces a durable outage of the database service.
Attack Vector
The attack path requires network reachability to the MySQL protocol endpoint and any authenticated session. An attacker submits a crafted query, statement, or payload that reaches JSON processing routines. Because the vulnerability is reachable through multiple protocols, exposure extends beyond the classic port 3306 listener. Refer to the Oracle Security Alert July 2026 for vendor-supplied technical context.
Detection Methods for CVE-2026-60718
Indicators of Compromise
- Unexpected mysqld process crashes or restarts recorded in system logs and MySQL error logs
- Sudden spikes in hung query threads, blocked connections, or session timeouts against MySQL Server or Cluster nodes
- Repeated authentication events from low-privileged accounts followed by service unavailability
Detection Strategies
- Monitor MySQL error log entries for repeated crash signatures involving JSON parsing or evaluation routines
- Correlate authenticated session activity from unusual sources with subsequent service degradation or restart events
- Baseline query patterns against JSON functions such as JSON_EXTRACT, JSON_TABLE, and JSON_VALUE and alert on statistical anomalies
Monitoring Recommendations
- Enable MySQL general query log or audit log on internet-exposed and internally-shared database tiers to capture pre-crash statements
- Forward mysqld crash telemetry and systemd restart events to a centralized SIEM for correlation
- Track database uptime and connection failure rates as service-level indicators for early detection of exploitation attempts
How to Mitigate CVE-2026-60718
Immediate Actions Required
- Apply the Oracle July 2026 Critical Patch Update for MySQL Server and MySQL Cluster versions 9.7.0 and 9.7.1
- Inventory all MySQL Server and MySQL Cluster deployments and confirm version status against the affected range
- Restrict network reachability to MySQL protocol endpoints to trusted application tiers and administrative subnets
Patch Information
Oracle addressed CVE-2026-60718 in the July 2026 Critical Patch Update. Administrators should upgrade to the fixed release documented in the Oracle Critical Patch Update Advisory - July 2026. Apply patches during a scheduled maintenance window and validate replication and cluster health after upgrade.
Workarounds
- Enforce least-privilege on MySQL user accounts and remove unnecessary low-privilege accounts that can authenticate remotely
- Place MySQL instances behind network access control lists that restrict client sources to known application hosts
- Rate-limit and monitor authentication attempts to reduce the blast radius of a repeated crash trigger
# Example: restrict MySQL access to a trusted application subnet using firewalld
sudo firewall-cmd --permanent --zone=drop --add-source=0.0.0.0/0
sudo firewall-cmd --permanent --zone=trusted --add-source=10.10.20.0/24
sudo firewall-cmd --permanent --zone=trusted --add-port=3306/tcp
sudo firewall-cmd --reload
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
