Is CVE-2026-60586 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-60586 being exploited in the wild.

How severe is CVE-2026-60586?

High severity, with a CVSS score of 7.7, published 21 July 2026.

Which products and versions are affected?

Oracle Connector/J 9.7.0 - 9.7.1.

Is there a fix for CVE-2026-60586?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-60586 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-60586?

Check whether you run Oracle Connector/J at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-60586: Oracle MySQL Connector/J unauthorized data access

CVE-2026-60586 · Severity: high · CVSS 7.7 · Published 2026-07-21

A vulnerability exists in the Oracle MySQL Connector/J, a software component that allows Java applications to communicate with MySQL databases. An attacker with low-level access to the network could exploit this flaw to gain unauthorized access to sensitive data. This could lead to a significant breach of confidential information across the affected systems and potentially impact other integrated products.

Technologies: Oracle Connector/J. Vendors: Oracle.

Quick answers

Is CVE-2026-60586 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-60586 being exploited in the wild.
How severe is CVE-2026-60586?: High severity, with a CVSS score of 7.7, published 21 July 2026.
Which products and versions are affected?: Oracle Connector/J 9.7.0 - 9.7.1.
Is there a fix for CVE-2026-60586?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-60586 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-60586?: Check whether you run Oracle Connector/J at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

This vulnerability affects the Connector/J component of Oracle MySQL Connectors. It is classified as easily exploitable, requiring only low privileges and network access via multiple protocols. The exploit results in a scope change (S:C), meaning the impact can extend beyond the MySQL Connector itself to other products or the underlying environment. The primary impact is a high loss of confidentiality (C:H), potentially allowing an attacker to access all data reachable by the connector. The vulnerability was disclosed as part of the Oracle Critical Patch Update for July 2026.

Affected products

Oracle MySQL Connectors (Connector/J) 9.7.0 - 9.7.1

Timeline

2026-07-21: advisory: Published as part of Oracle Critical Patch Update
2026-07-21: disclosed

References

https://www.oracle.com/security-alerts/cpujul2026.html

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.