CVE-2026-60747: MySQL Server & Cluster DoS Vulnerability

CVE-2026-60747 Overview

CVE-2026-60747 is a denial-of-service vulnerability in the Replication component of Oracle MySQL Server and MySQL Cluster. An unauthenticated attacker with local logon access to the infrastructure hosting MySQL can trigger a hang or repeatable crash. Successful exploitation results in a complete denial of service of the affected database instance.

Affected releases include MySQL Server versions 8.4.0 through 8.4.10 and 9.7.0 through 9.7.1. MySQL Cluster is affected across versions 8.0.0 through 8.0.47, 8.4.0 through 8.4.10, and 9.7.0 through 9.7.1. Oracle addressed the issue in the July 2026 Critical Patch Update.

Critical Impact
Unauthenticated local attackers can hang or crash MySQL Server and MySQL Cluster instances, causing complete availability loss for dependent applications.

Affected Products

Oracle MySQL Server versions 8.4.0 through 8.4.10 and 9.7.0 through 9.7.1
Oracle MySQL Cluster versions 8.0.0 through 8.0.47 and 8.4.0 through 8.4.10
Oracle MySQL Cluster versions 9.7.0 through 9.7.1

Discovery Timeline

2026-07-21 - CVE-2026-60747 published to the National Vulnerability Database
2026-07-21 - Last updated in NVD database
July 2026 - Oracle releases fix as part of the Critical Patch Update

Technical Details for CVE-2026-60747

Vulnerability Analysis

The vulnerability resides in the Replication component of MySQL Server and MySQL Cluster. Replication handles the flow of binary log events between primary and replica nodes. A malformed or unexpected condition processed by this subsystem causes the affected server to hang or crash.

The flaw is classified as a denial-of-service issue with availability impact only. Confidentiality and integrity are not affected. The attack complexity is low, and no user interaction or prior authentication to MySQL is required.

The EPSS probability is 0.123%, indicating a low modeled likelihood of exploitation activity in the near term. No public proof-of-concept code or in-the-wild exploitation has been reported.

Root Cause

Oracle has not published component-level technical details for this issue. Based on the advisory, the fault occurs within the Replication subsystem, where input processing does not gracefully handle a specific condition. The result is a fatal server state that terminates or stalls the MySQL process.

Attack Vector

Exploitation requires local access to the infrastructure where MySQL Server or MySQL Cluster runs. The attacker does not need MySQL credentials but must have logon access to the host or an adjacent process context that can interact with the replication interface. Once positioned, the attacker can send crafted input that reaches the replication code path and forces a crash or hang.

Because exploitation causes a full denial of service, repeated triggers can prevent the database from returning to a healthy state until administrators intervene. Environments with automatic restart policies may experience crash loops if the triggering condition persists.

No verified exploitation code is publicly available. See the Oracle Critical Patch Update advisory for the authoritative technical reference.

Detection Methods for CVE-2026-60747

Indicators of Compromise

Unexpected mysqld process crashes or hangs on hosts running affected versions, particularly with stack traces referencing replication threads
Repeated restart events in systemd or service manager logs for the MySQL service without administrator-initiated action
Replication I/O or SQL thread errors in the MySQL error log immediately preceding a crash

Detection Strategies

Monitor MySQL error logs for abnormal replication thread termination, assertion failures, or signal-based shutdowns
Correlate MySQL service restart events with local user session activity to identify unauthorized local interactions
Track availability metrics for MySQL endpoints and alert on service downtime that exceeds established baselines

Monitoring Recommendations

Enable auditing of local logon events on database hosts and forward these events to a centralized logging platform
Alert on any process spawned by non-database service accounts that interacts with MySQL socket files or replication ports
Track binary log and relay log write anomalies that coincide with replication thread failures

How to Mitigate CVE-2026-60747

Immediate Actions Required

Apply the July 2026 Oracle Critical Patch Update to all affected MySQL Server and MySQL Cluster deployments
Inventory MySQL instances and confirm versions against the affected ranges 8.0.0-8.0.47, 8.4.0-8.4.10, and 9.7.0-9.7.1
Restrict local logon on database hosts to a minimum set of administrative accounts

Patch Information

Oracle addressed CVE-2026-60747 in the July 2026 Critical Patch Update. Administrators should upgrade to a fixed release listed in the advisory. See the Oracle Critical Patch Update advisory for version-specific fix information and download instructions.

Workarounds

Enforce strict host-level access controls so that only trusted administrators can log on to systems running MySQL Server or MySQL Cluster
Isolate MySQL infrastructure on dedicated hosts or network segments to reduce the population of potential local attackers
Configure service watchdogs and clustered failover to reduce recovery time if a crash occurs before patching is complete

bash

# Verify installed MySQL Server version against affected ranges
mysql --version
mysqld --version

# List local user sessions on database hosts to review logon access
last -n 50
who