# CVE-2026-60586: Oracle MySQL Connector/J unauthorized data access

Source: https://junglewise.ai/threats/cve-2026-60586-oracle-mysql-connector-j-unauthorized-data-access  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-21. Updated: 2026-07-22  
License: CC BY 4.0 with a link back

CVE-2026-60586 · Severity: high · CVSS 7.7 · Published 2026-07-21

A vulnerability exists in the Oracle MySQL Connector/J, a software component that allows Java applications to communicate with MySQL databases. An attacker with low-level access to the network could exploit this flaw to gain unauthorized access to sensitive data. This could lead to a significant breach of confidential information across the affected systems and potentially impact other integrated products.

Technologies: [Oracle Connector/J](https://junglewise.ai/threats/technologies/connector-j). Vendors: [Oracle](https://junglewise.ai/threats/vendors/oracle).

## Quick answers

**Is CVE-2026-60586 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-60586 being exploited in the wild.

**How severe is CVE-2026-60586?** High severity, with a CVSS score of 7.7, published 21 July 2026.

**Which products and versions are affected?** Oracle Connector/J 9.7.0 - 9.7.1.

**Is there a fix for CVE-2026-60586?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-60586 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-60586?** Check whether you run Oracle Connector/J at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

This vulnerability affects the Connector/J component of Oracle MySQL Connectors. It is classified as easily exploitable, requiring only low privileges and network access via multiple protocols. The exploit results in a scope change (S:C), meaning the impact can extend beyond the MySQL Connector itself to other products or the underlying environment. The primary impact is a high loss of confidentiality (C:H), potentially allowing an attacker to access all data reachable by the connector. The vulnerability was disclosed as part of the Oracle Critical Patch Update for July 2026.

## Affected products

- Oracle MySQL Connectors (Connector/J) 9.7.0 - 9.7.1

## Timeline

- 2026-07-21: advisory: Published as part of Oracle Critical Patch Update
- 2026-07-21: disclosed

## References

- [https://www.oracle.com/security-alerts/cpujul2026.html](https://www.oracle.com/security-alerts/cpujul2026.html)

## Related threats

- [Oracle MySQL Connector/J unauthorized data access](https://junglewise.ai/threats/cve-2026-61082-oracle-mysql-connector-j-unauthorized-data-access)
- [Oracle MySQL Connector/J denial of service](https://junglewise.ai/threats/cve-2026-60624-oracle-mysql-connector-j-denial-of-service)
- [Oracle MySQL Connector/J unauthorized data access and modification](https://junglewise.ai/threats/cve-2026-60623-oracle-mysql-connector-j-unauthorized-data-access-and)