CVE-2026-60181: Medium severity Oracle MySQL Server vulnerability

Q: What is the severity of CVE-2026-60181?

The severity of CVE-2026-60181 is medium with a CVSS score of 6.7.

Q: How do I fix CVE-2026-60181?

To fix CVE-2026-60181, upgrade to MySQL Server or MySQL Cluster versions beyond 9.7.1.

Q: Who is affected by CVE-2026-60181?

CVE-2026-60181 affects users running MySQL Server versions 9.7.0 to 9.7.1 and MySQL Cluster versions 9.7.0 to 9.7.1.

Q: What types of attacks can exploit CVE-2026-60181?

CVE-2026-60181 can be exploited by low privileged attackers with logon access to the infrastructure.

Q: What component of MySQL Server is involved in CVE-2026-60181?

CVE-2026-60181 involves the Configurator component of the MySQL Server.

Published Jul 21, 2026

Updated

Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Configurator). Supported versions that are affected are MySQL Server: 9.7.0-9.7.1; MySQL Cluster: 9.7.0-9.7.1. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where MySQL Server, MySQL Cluster executes to compromise MySQL Server, MySQL Cluster. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 6.7 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H).

Affected Software

6 affected components

Oracle MySQL Server>=9.7.0<=9.7.1

Oracle MySQL Cluster>=9.7.0<=9.7.1

Oracle MySQL Server=9.7.0

Oracle MySQL Server=9.7.1

Oracle MySQL Cluster=9.7.0

Oracle MySQL Cluster=9.7.1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade MySQL Server / MySQL Cluster (Oracle MySQL) to a version that resolves this vulnerability.
Fixed in 9.7.0-9.7.1
Compensating control
Because successful attacks require human interaction and low-privileged access (CVSS: AV:L/AC:H/PR:L), restrict access to the MySQL Server/MySQL Cluster environments (and any components involved such as the Server: Configurator) to trusted, minimal-privilege users and control human access workflows to reduce the chance of exploitation.

Event History

Jul 21, 2026

CVE Published

via MITRE·09:33 PM

Data Sourced

via MITRE·09:33 PM

DescriptionSeverity

Data Sourced

via NVD·10:17 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2026-60181?

The severity of CVE-2026-60181 is medium with a CVSS score of 6.7.

How do I fix CVE-2026-60181?