CVE-2026-60185·MySQL vulnerability
Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication). Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and 9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H).
- Severity
- medium
- Software
- MySQL
- Fixed in
- 8.0.46-0ubuntu0.22.04.4
- Published
How likely is exploitation
FIRST's Exploit Prediction Scoring System puts the probability of this CVE being exploited in the next 30 days at 0.34% — higher than 27% of all published CVEs. EPSS is an independent forecast of exploitation, not a severity rating: it says nothing about how much damage a successful attack does, which is what a CVSS score measures.
Affected versions
From: 8.4.0
Until: 8.4.10
Fixed in: 8.0.46-0ubuntu0.22.04.4
How to fix this CVE
Upgrade MySQL Server to version 8.0.46 or later to resolve this replication-layer denial-of-service vulnerability. Administrators with high privilege levels should prioritize patching systems running affected versions 8.4.0–8.4.10 to prevent potential service disruptions triggered by authenticated attackers with network access. While exploitation requires elevated privileges and specific conditions, the impact of a successful attack includes complete database unavailability.
sudo dnf check-update mysql-server && sudo dnf update mysql-serverDefensia detects this vulnerability
How to check if you are affected
- Step 1: Check installed MySQL version with: mysql --version or SELECT VERSION();
- Step 2: Verify replication status and configuration: SHOW SLAVE STATUS\G or SHOW REPLICA STATUS\G
- Step 3: Review MySQL error logs for unexpected crashes or hung threads: tail -f /var/log/mysql/error.log | grep -i 'hang\|crash\|replication'
- Step 4: After patching, confirm the new version is loaded: systemctl restart mysql && mysql --version
FAQ
What is CVE-2026-60185?
CVE-2026-60185 is a vulnerability in MySQL's replication subsystem that allows authenticated high-privilege users to trigger a denial-of-service condition, causing the database server to hang or crash. The vulnerability exists in specific versions of MySQL Server and MySQL Cluster with medium severity (CVSS 4.4).
Is CVE-2026-60185 being actively exploited?
No, CVE-2026-60185 is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog and no public exploits are currently available, reducing immediate threat risk for most environments.
What versions of MySQL are affected by CVE-2026-60185?
MySQL Server versions 8.4.0 through 8.4.10 and 9.7.0 through 9.7.1, as well as MySQL Cluster versions 8.0.0 through 8.0.47, 8.4.0 through 8.4.10, and 9.7.0 through 9.7.1 are vulnerable.
How do I check if my server is vulnerable to CVE-2026-60185?
Run: mysql --version or connect to MySQL and execute SELECT VERSION(); then compare the output against the affected version ranges (8.4.0–8.4.10 or 9.7.0–9.7.1). If your version falls within these ranges, your system is vulnerable.
Does Defensia detect CVE-2026-60185?
Yes — Defensia's CVE advisory scanner compares installed package versions against the NVD database. If MySQL is installed on a monitored server, CVE-2026-60185 will appear in your dashboard with remediation steps.
Related MySQL CVEs
References
Track CVEs across your fleet automatically
Defensia scans your Linux servers and tells you exactly which ones are running vulnerable versions — including CVE-2026-60185. Free for 1 server.
Get started free