Executive brief
A vulnerability exists in the Group Replication Plugin of Oracle MySQL Server and MySQL Cluster, which are widely used database management systems. A highly privileged attacker could exploit this flaw to cause the database to hang or crash repeatedly. This would result in a complete denial of service, preventing applications and users from accessing critical data.
Technical details
A vulnerability in the Group Replication Plugin component of Oracle MySQL Server and MySQL Cluster allows for a denial of service (DoS). The flaw is categorized as difficult to exploit, requiring a high-privileged attacker with network access via multiple protocols. Successful exploitation results in the unauthorized ability to cause a hang or a frequently repeatable crash of the affected database instance. Affected versions include MySQL Server 8.4.0-8.4.10 and 9.7.0-9.7.1, and MySQL Cluster 8.0.0-8.0.47, 8.4.0-8.4.10, and 9.7.0-9.7.1. Users are advised to refer to the Oracle Critical Patch Update for July 2026 for remediation details.
Affected products
- Oracle MySQL Server 8.4.0-8.4.10, 9.7.0-9.7.1
- Oracle MySQL Cluster 8.0.0-8.0.47, 8.4.0-8.4.10, 9.7.0-9.7.1
Timeline
- 2026-07-21: advisory: Initial publication of CVE-2026-60186 by Oracle