CVE-2026-60184·MySQL vulnerability
Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication). Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and 9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H).
- Severity
- medium
- Software
- MySQL
- Fixed in
- 8.0.46-0ubuntu0.22.04.4
- Published
How likely is exploitation
FIRST's Exploit Prediction Scoring System puts the probability of this CVE being exploited in the next 30 days at 0.34% — higher than 27% of all published CVEs. EPSS is an independent forecast of exploitation, not a severity rating: it says nothing about how much damage a successful attack does, which is what a CVSS score measures.
Affected versions
From: 8.4.0
Until: 8.4.10
Fixed in: 8.0.46-0ubuntu0.22.04.4
How to fix this CVE
Update MySQL Server to version 8.0.46 or later to patch this replication-related denial-of-service vulnerability. High-privileged database administrators should prioritize this update, as the flaw allows authenticated attackers to trigger server hangs or crashes through the replication subsystem. Apply the patch during a maintenance window to minimize downtime.
sudo dnf update mysql-serverDefensia detects this vulnerability
How to check if you are affected
- Step 1: Check installed MySQL version with: mysql --version or SELECT VERSION(); from the MySQL shell
- Step 2: Query SHOW SLAVE STATUS\G or SHOW REPLICA STATUS\G to verify replication is active and identify any unusual connection states
- Step 3: Search application and MySQL error logs for entries containing 'replication thread', 'crash', or 'hang' around the time of suspected exploitation: grep -i 'replication\|crash\|hang' /var/log/mysql/error.log
- Step 4: Verify patch application by confirming MySQL version is 8.0.46 or later and checking package signature: apt-cache policy mysql-server (Ubuntu/Debian) or dnf list mysql-server (RHEL/CentOS)
FAQ
What is CVE-2026-60184?
CVE-2026-60184 is a denial-of-service vulnerability in MySQL Server's replication component that allows high-privileged attackers to trigger server hangs or crashes. Exploitation requires network access and elevated database privileges, making it a targeted risk for multi-tier database architectures.
Is CVE-2026-60184 being actively exploited?
No, this vulnerability is not currently listed as actively exploited by CISA, and no public exploit code is available. However, organizations running affected versions should still apply patches proactively given the availability impact.
What versions of MySQL are affected by CVE-2026-60184?
MySQL Server versions 8.4.0 through 8.4.10 and 9.7.0 through 9.7.1 are affected, along with MySQL Cluster versions 8.0.0-8.0.47, 8.4.0-8.4.10, and 9.7.0-9.7.1. The fix is available in version 8.0.46 and later.
How do I check if my server is vulnerable to CVE-2026-60184?
Execute SELECT VERSION(); in MySQL and compare the version number against the affected ranges (8.4.0-8.4.10, 9.7.0-9.7.1). If your version falls within these ranges, your server requires patching.
Does Defensia detect CVE-2026-60184?
Yes — Defensia's CVE advisory scanner compares installed package versions against the NVD database. If MySQL is installed on a monitored server, CVE-2026-60184 will appear in your dashboard with remediation steps.
Related MySQL CVEs
References
Track CVEs across your fleet automatically
Defensia scans your Linux servers and tells you exactly which ones are running vulnerable versions — including CVE-2026-60184. Free for 1 server.
Get started free