Vulnerability-Lookup

CVE-2026-60314 (GCVE-0-2026-60314)

Vulnerability from cvelistv5 – Published: 2026-07-21 21:34 – Updated: 2026-07-23 19:18

Summary

Vulnerability in the MySQL Router product of Oracle MySQL (component: Router: General). Supported versions that are affected are 8.4.0-8.4.10 and 9.7.0-9.7.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise MySQL Router. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Router. CVSS 3.1 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-07-23 19:14 UTC

CWE

Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise MySQL Router. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Router.
CWE-400 - Uncontrolled Resource Consumption

Assigner

oracle mitre root

References

1 reference

URL	Tags
https://www.oracle.com/security-alerts/cpujul2026.html	vendor-advisory

Impacted products

1 product

Vendor	Product	Version	CPE status
Oracle Corporation	MySQL Router	Affected: 8.4.0 , ≤ 8.4.10 (custom) Affected: 9.7.0 , ≤ 9.7.1 (custom) cpe:2.3:a:oracle:mysql_router:::::::: cpe:2.3:a:oracle:mysql_router::::::::

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-60314",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-23T19:14:54.140978Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-400",
                "description": "CWE-400 Uncontrolled Resource Consumption",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-23T19:18:34.907Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "MySQL Router",
          "vendor": "Oracle Corporation",
          "versions": [
            {
              "lessThanOrEqual": "8.4.10",
              "status": "affected",
              "version": "8.4.0",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "9.7.1",
              "status": "affected",
              "version": "9.7.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:oracle:mysql_router:*:*:*:*:*:*:*:*",
                  "versionEndIncluding": "8.4.10",
                  "versionStartIncluding": "8.4.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:oracle:mysql_router:*:*:*:*:*:*:*:*",
                  "versionEndIncluding": "9.7.1",
                  "versionStartIncluding": "9.7.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en-US",
          "value": "Vulnerability in the MySQL Router product of Oracle MySQL (component: Router: General).  Supported versions that are affected are 8.4.0-8.4.10 and  9.7.0-9.7.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise MySQL Router.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Router. CVSS 3.1 Base Score 7.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise MySQL Router.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Router.",
              "lang": "en-US"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-21T21:34:23.773Z",
        "orgId": "43595867-4340-4103-b7a2-9a5208d29a85",
        "shortName": "oracle"
      },
      "references": [
        {
          "name": "Oracle Advisory",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.oracle.com/security-alerts/cpujul2026.html"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "43595867-4340-4103-b7a2-9a5208d29a85",
    "assignerShortName": "oracle",
    "cveId": "CVE-2026-60314",
    "datePublished": "2026-07-21T21:34:23.773Z",
    "dateReserved": "2026-07-08T15:51:40.529Z",
    "dateUpdated": "2026-07-23T19:18:34.907Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-60314",
      "date": "2026-09-22",
      "epss": "0.00366",
      "percentile": "0.30415"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "product": "MySQL Router",
                "vendor": "Oracle Corporation",
                "versions": [
                  {
                    "lessThanOrEqual": "8.4.10",
                    "status": "affected",
                    "version": "8.4.0",
                    "versionType": "custom"
                  },
                  {
                    "lessThanOrEqual": "9.7.1",
                    "status": "affected",
                    "version": "9.7.0",
                    "versionType": "custom"
                  }
                ]
              }
            ],
            "source": "secalert_us@oracle.com"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:oracle:mysql_router:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "A13721AA-321C-4E34-8A96-413227115A3E",
                    "versionEndIncluding": "8.4.10",
                    "versionStartIncluding": "8.4.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:oracle:mysql_router:9.7.0:*:*:*:*:*:*:*",
                    "matchCriteriaId": "A6E5489F-A6EE-4C87-9106-4D5055573962",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:oracle:mysql_router:9.7.1:*:*:*:*:*:*:*",
                    "matchCriteriaId": "919B46A0-319C-4E30-8C73-685F0B3F8438",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "Vulnerability in the MySQL Router product of Oracle MySQL (component: Router: General).  Supported versions that are affected are 8.4.0-8.4.10 and  9.7.0-9.7.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise MySQL Router.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Router. CVSS 3.1 Base Score 7.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)."
          }
        ],
        "id": "CVE-2026-60314",
        "lastModified": "2026-07-28T17:19:35.453",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 7.5,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 3.6,
              "source": "secalert_us@oracle.com",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2026-60314",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "yes"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-23T19:14:54.140978Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2026-07-21T22:17:34.173",
        "references": [
          {
            "source": "secalert_us@oracle.com",
            "tags": [
              "Vendor Advisory"
            ],
            "url": "https://www.oracle.com/security-alerts/cpujul2026.html"
          }
        ],
        "sourceIdentifier": "secalert_us@oracle.com",
        "vulnStatus": "Analyzed",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-400"
              }
            ],
            "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
            "type": "Secondary"
          }
        ]
      }
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-60314",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "yes"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-07-23T19:14:54.140978Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "problemTypes": [
              {
                "descriptions": [
                  {
                    "cweId": "CWE-400",
                    "description": "CWE-400 Uncontrolled Resource Consumption",
                    "lang": "en",
                    "type": "CWE"
                  }
                ]
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-07-23T19:15:30.352Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "product": "MySQL Router",
              "vendor": "Oracle Corporation",
              "versions": [
                {
                  "lessThanOrEqual": "8.4.10",
                  "status": "affected",
                  "version": "8.4.0",
                  "versionType": "custom"
                },
                {
                  "lessThanOrEqual": "9.7.1",
                  "status": "affected",
                  "version": "9.7.0",
                  "versionType": "custom"
                }
              ]
            }
          ],
          "cpeApplicability": [
            {
              "nodes": [
                {
                  "cpeMatch": [
                    {
                      "criteria": "cpe:2.3:a:oracle:mysql_router:*:*:*:*:*:*:*:*",
                      "versionEndIncluding": "8.4.10",
                      "versionStartIncluding": "8.4.0",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:a:oracle:mysql_router:*:*:*:*:*:*:*:*",
                      "versionEndIncluding": "9.7.1",
                      "versionStartIncluding": "9.7.0",
                      "vulnerable": true
                    }
                  ],
                  "negate": false,
                  "operator": "OR"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en-US",
              "value": "Vulnerability in the MySQL Router product of Oracle MySQL (component: Router: General).  Supported versions that are affected are 8.4.0-8.4.10 and  9.7.0-9.7.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise MySQL Router.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Router. CVSS 3.1 Base Score 7.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 7.5,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.1"
              }
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "description": "Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise MySQL Router.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Router.",
                  "lang": "en-US"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-07-21T21:34:23.773Z",
            "orgId": "43595867-4340-4103-b7a2-9a5208d29a85",
            "shortName": "oracle"
          },
          "references": [
            {
              "name": "Oracle Advisory",
              "tags": [
                "vendor-advisory"
              ],
              "url": "https://www.oracle.com/security-alerts/cpujul2026.html"
            }
          ]
        }
      },
      "cveMetadata": {
        "assignerOrgId": "43595867-4340-4103-b7a2-9a5208d29a85",
        "assignerShortName": "oracle",
        "cveId": "CVE-2026-60314",
        "datePublished": "2026-07-21T21:34:23.773Z",
        "dateReserved": "2026-07-08T15:51:40.529Z",
        "dateUpdated": "2026-07-23T19:18:34.907Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

CERTFR-2026-AVI-0916

Vulnerability from certfr_avis - Published: 2026-07-23 - Updated: 2026-07-23

De multiples vulnérabilités ont été découvertes dans Oracle MySQL. Elles permettent à un attaquant de provoquer un déni de service à distance, une atteinte à la confidentialité des données et une atteinte à l'intégrité des données.

Solutions

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Impacted products

Vendor	Product	Description
Oracle	MySQL	MySQL Connectors versions 9.7.0 à 9.7.1
Oracle	MySQL	MySQL Router versions 8.4.0 à 8.4.10
Oracle	MySQL	MySQL Server versions 9.7.0 à 9.7.1
Oracle	MySQL	MySQL Cluster versions 9.7.0 à 9.7.1
Oracle	MySQL	MySQL Cluster versions 8.0.0 à 8.0.47
Oracle	MySQL	MySQL Cluster versions 8.4.0 à 8.4.10
Oracle	MySQL	MySQL Router versions 9.7.0 à 9.7.1
Oracle	MySQL	Oracle Enterprise Manager for MySQL Database versions 13.5.4.0.0 à 13.5.5.0.0
Oracle	MySQL	MySQL Server versions 8.4.0 à 8.4.10

References

Title

Publication Time

Tags

Bulletin de sécurité Oracle MySQL cpujul2026

2026-07-21

vendor-advisory

Show details on source website

JSON

To clipboard

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "MySQL Connectors versions 9.7.0 \u00e0 9.7.1",
      "product": {
        "name": "MySQL",
        "vendor": {
          "name": "Oracle",
          "scada": false
        }
      }
    },
    {
      "description": "MySQL Router versions 8.4.0 \u00e0 8.4.10",
      "product": {
        "name": "MySQL",
        "vendor": {
          "name": "Oracle",
          "scada": false
        }
      }
    },
    {
      "description": "MySQL Server versions 9.7.0 \u00e0 9.7.1",
      "product": {
        "name": "MySQL",
        "vendor": {
          "name": "Oracle",
          "scada": false
        }
      }
    },
    {
      "description": "MySQL Cluster versions 9.7.0 \u00e0 9.7.1",
      "product": {
        "name": "MySQL",
        "vendor": {
          "name": "Oracle",
          "scada": false
        }
      }
    },
    {
      "description": "MySQL Cluster versions 8.0.0 \u00e0 8.0.47",
      "product": {
        "name": "MySQL",
        "vendor": {
          "name": "Oracle",
          "scada": false
        }
      }
    },
    {
      "description": "MySQL Cluster versions 8.4.0 \u00e0 8.4.10",
      "product": {
        "name": "MySQL",
        "vendor": {
          "name": "Oracle",
          "scada": false
        }
      }
    },
    {
      "description": "MySQL Router versions 9.7.0 \u00e0 9.7.1",
      "product": {
        "name": "MySQL",
        "vendor": {
          "name": "Oracle",
          "scada": false
        }
      }
    },
    {
      "description": "Oracle Enterprise Manager for MySQL Database versions 13.5.4.0.0 \u00e0 13.5.5.0.0",
      "product": {
        "name": "MySQL",
        "vendor": {
          "name": "Oracle",
          "scada": false
        }
      }
    },
    {
      "description": "MySQL Server versions 8.4.0 \u00e0 8.4.10",
      "product": {
        "name": "MySQL",
        "vendor": {
          "name": "Oracle",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": "",
  "content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
  "cves": [
    {
      "name": "CVE-2026-60315",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-60315"
    },
    {
      "name": "CVE-2026-61093",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-61093"
    },
    {
      "name": "CVE-2026-60718",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-60718"
    },
    {
      "name": "CVE-2026-60314",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-60314"
    },
    {
      "name": "CVE-2026-60190",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-60190"
    },
    {
      "name": "CVE-2026-60187",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-60187"
    },
    {
      "name": "CVE-2026-60179",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-60179"
    },
    {
      "name": "CVE-2026-61081",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-61081"
    },
    {
      "name": "CVE-2026-60332",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-60332"
    },
    {
      "name": "CVE-2026-60586",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-60586"
    },
    {
      "name": "CVE-2026-60174",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-60174"
    },
    {
      "name": "CVE-2026-60193",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-60193"
    },
    {
      "name": "CVE-2026-60624",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-60624"
    },
    {
      "name": "CVE-2026-47052",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-47052"
    },
    {
      "name": "CVE-2026-60191",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-60191"
    },
    {
      "name": "CVE-2026-46936",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-46936"
    },
    {
      "name": "CVE-2026-60163",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-60163"
    },
    {
      "name": "CVE-2026-47008",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-47008"
    },
    {
      "name": "CVE-2026-60178",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-60178"
    },
    {
      "name": "CVE-2026-60569",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-60569"
    },
    {
      "name": "CVE-2026-60195",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-60195"
    },
    {
      "name": "CVE-2025-68161",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-68161"
    },
    {
      "name": "CVE-2026-60747",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-60747"
    },
    {
      "name": "CVE-2026-60184",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-60184"
    },
    {
      "name": "CVE-2026-60183",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-60183"
    },
    {
      "name": "CVE-2026-60188",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-60188"
    },
    {
      "name": "CVE-2026-61108",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-61108"
    },
    {
      "name": "CVE-2026-60181",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-60181"
    },
    {
      "name": "CVE-2026-60331",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-60331"
    },
    {
      "name": "CVE-2026-60725",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-60725"
    },
    {
      "name": "CVE-2026-60317",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-60317"
    },
    {
      "name": "CVE-2026-60189",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-60189"
    },
    {
      "name": "CVE-2026-60623",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-60623"
    },
    {
      "name": "CVE-2026-61094",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-61094"
    },
    {
      "name": "CVE-2026-60180",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-60180"
    },
    {
      "name": "CVE-2026-60324",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-60324"
    },
    {
      "name": "CVE-2026-60311",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-60311"
    },
    {
      "name": "CVE-2026-61109",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-61109"
    },
    {
      "name": "CVE-2026-60182",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-60182"
    },
    {
      "name": "CVE-2026-47023",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-47023"
    },
    {
      "name": "CVE-2026-60316",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-60316"
    },
    {
      "name": "CVE-2026-47012",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-47012"
    },
    {
      "name": "CVE-2026-61128",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-61128"
    },
    {
      "name": "CVE-2026-60145",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-60145"
    },
    {
      "name": "CVE-2026-61082",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-61082"
    },
    {
      "name": "CVE-2026-60171",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-60171"
    },
    {
      "name": "CVE-2026-60192",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-60192"
    },
    {
      "name": "CVE-2026-60186",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-60186"
    },
    {
      "name": "CVE-2026-47064",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-47064"
    },
    {
      "name": "CVE-2026-61096",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-61096"
    },
    {
      "name": "CVE-2026-60194",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-60194"
    },
    {
      "name": "CVE-2026-61144",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-61144"
    },
    {
      "name": "CVE-2026-60185",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-60185"
    },
    {
      "name": "CVE-2026-60177",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-60177"
    },
    {
      "name": "CVE-2026-60585",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-60585"
    }
  ],
  "initial_release_date": "2026-07-23T00:00:00",
  "last_revision_date": "2026-07-23T00:00:00",
  "links": [],
  "reference": "CERTFR-2026-AVI-0916",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2026-07-23T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "D\u00e9ni de service \u00e0 distance"
    },
    {
      "description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans Oracle MySQL. Elles permettent \u00e0 un attaquant de provoquer un d\u00e9ni de service \u00e0 distance, une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es et une atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es.",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans Oracle MySQL",
  "vendor_advisories": [
    {
      "published_at": "2026-07-21",
      "title": "Bulletin de s\u00e9curit\u00e9 Oracle MySQL cpujul2026",
      "url": "https://www.oracle.com/security-alerts/cpujul2026.html"
    }
  ]
}

FKIE_CVE-2026-60314

Vulnerability from fkie_nvd - Published: 2026-07-21 22:17 - Updated: 2026-07-28 17:19

Severity

7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Summary

References

	URL	Tags
	secalert_us@oracle.com	https://www.oracle.com/security-alerts/cpujul2026.html	Vendor Advisory

Impacted products

Vendor	Product	Version
oracle	mysql_router	*
oracle	mysql_router	9.7.0
oracle	mysql_router	9.7.1

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "MySQL Router",
          "vendor": "Oracle Corporation",
          "versions": [
            {
              "lessThanOrEqual": "8.4.10",
              "status": "affected",
              "version": "8.4.0",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "9.7.1",
              "status": "affected",
              "version": "9.7.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "source": "secalert_us@oracle.com"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:oracle:mysql_router:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "A13721AA-321C-4E34-8A96-413227115A3E",
              "versionEndIncluding": "8.4.10",
              "versionStartIncluding": "8.4.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:mysql_router:9.7.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "A6E5489F-A6EE-4C87-9106-4D5055573962",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:mysql_router:9.7.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "919B46A0-319C-4E30-8C73-685F0B3F8438",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Vulnerability in the MySQL Router product of Oracle MySQL (component: Router: General).  Supported versions that are affected are 8.4.0-8.4.10 and  9.7.0-9.7.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise MySQL Router.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Router. CVSS 3.1 Base Score 7.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)."
    }
  ],
  "id": "CVE-2026-60314",
  "lastModified": "2026-07-28T17:19:35.453",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6,
        "source": "secalert_us@oracle.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-60314",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-07-23T19:14:54.140978Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-07-21T22:17:34.173",
  "references": [
    {
      "source": "secalert_us@oracle.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://www.oracle.com/security-alerts/cpujul2026.html"
    }
  ],
  "sourceIdentifier": "secalert_us@oracle.com",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-400"
        }
      ],
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "type": "Secondary"
    }
  ]
}

GHSA-MCF6-CWJW-4HQ9

Vulnerability from github – Published: 2026-07-22 00:31 – Updated: 2026-07-22 00:31

Details

Severity

7.5 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-60314"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-400"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-07-21T22:17:34Z",
    "severity": "HIGH"
  },
  "details": "Vulnerability in the MySQL Router product of Oracle MySQL (component: Router: General).  Supported versions that are affected are 8.4.0-8.4.10 and  9.7.0-9.7.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise MySQL Router.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Router. CVSS 3.1 Base Score 7.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).",
  "id": "GHSA-mcf6-cwjw-4hq9",
  "modified": "2026-07-22T00:31:33Z",
  "published": "2026-07-22T00:31:33Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-60314"
    },
    {
      "type": "WEB",
      "url": "https://www.oracle.com/security-alerts/cpujul2026.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

NCSC-2026-0262

Vulnerability from csaf_ncscnl - Published: 2026-07-22 15:25 - Updated: 2026-07-22 15:25

Summary

Kwetsbaarheden verholpen in Oracle MySQL Server en MySQL Cluster

Scope

54 vulnerabilities in this advisory, including CVE-2026-60314.

CVE-2026-60314

A denial of service vulnerability in Oracle MySQL Router versions 8.4.0-8.4.10 and 9.7.0-9.7.1 allows unauthenticated network attackers via HTTP to crash or hang the service, with a CVSS 3.1 base score of 7.5.

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Known affected: 4 products

Open the full advisory

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-60314 (GCVE-0-2026-60314)

CERTFR-2026-AVI-0916

Solutions

FKIE_CVE-2026-60314

GHSA-MCF6-CWJW-4HQ9

NCSC-2026-0262

Tags

Sightings

Nomenclature

Related by attack behaviour