CVE-2026-60177: Medium severity Oracle MySQL Server vulnerability
Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Clone Plugin). Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and 9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Mitigate the availability impact by isolating MySQL Server/MySQL Cluster network exposure (e.g., restrict inbound access to the required MySQL ports/protocols) since the issue has network access (AV:N) and causes hang/crash (A:H).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-60177?
The severity of CVE-2026-60177 is medium, with a CVSS score of 4.4.
How do I fix CVE-2026-60177?
To fix CVE-2026-60177, update your MySQL Server or MySQL Cluster to a version that is not affected by the vulnerability.
Which MySQL versions are affected by CVE-2026-60177?
The affected MySQL versions are 8.4.0-8.4.10, 9.7.0-9.7.1, and MySQL Cluster versions 8.0.0-8.0.47, 8.4.0-8.4.10, and 9.7.0-9.7.1.
Is CVE-2026-60177 easy to exploit?
CVE-2026-60177 is described as a difficult to exploit vulnerability.
What components of Oracle MySQL are affected by CVE-2026-60177?
CVE-2026-60177 affects the Server: Clone Plugin component of Oracle MySQL.