CVE-2026-60186·MySQL vulnerability
Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Group Replication Plugin). Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and 9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H).
- Severity
- medium
- Software
- MySQL
- Fixed in
- 8.0.46-0ubuntu0.22.04.4
- Published
How likely is exploitation
FIRST's Exploit Prediction Scoring System puts the probability of this CVE being exploited in the next 30 days at 0.34% — higher than 26% of all published CVEs. EPSS is an independent forecast of exploitation, not a severity rating: it says nothing about how much damage a successful attack does, which is what a CVSS score measures.
Affected versions
From: 8.4.0
Until: 8.4.10
Fixed in: 8.0.46-0ubuntu0.22.04.4
How to fix this CVE
This vulnerability in MySQL Server's Group Replication Plugin allows high-privileged attackers to trigger a denial-of-service condition through network access. Organizations running affected versions (8.4.0-8.4.10, 9.7.0-9.7.1) should upgrade to version 8.0.46 or later, or apply patches from Oracle's July 2026 security bulletin. While exploitation requires administrative credentials, patching should be prioritized as part of regular maintenance cycles to eliminate this DoS vector.
sudo dnf update mysql-serverDefensia detects this vulnerability
How to check if you are affected
- Check installed MySQL version: mysql --version
- Query the server for version details: mysql -u root -p -e 'SELECT VERSION();'
- List all Group Replication plugin threads: mysql -u root -p -e 'SELECT * FROM performance_schema.threads WHERE thread_name LIKE "%group_replication%";'
- Review MySQL error log for crashes or hangs: sudo tail -f /var/log/mysql/error.log | grep -i 'group_replication\|crash\|hang'
- Verify patch applied: dpkg -l | grep mysql-server (Ubuntu/Debian) or rpm -qa | grep mysql-server (RHEL/CentOS)
FAQ
What is CVE-2026-60186?
This is a vulnerability in MySQL Server and MySQL Cluster's Group Replication Plugin that allows a high-privileged attacker with network access to trigger a denial-of-service condition, causing the database to hang or crash repeatedly.
Is CVE-2026-60186 being actively exploited?
No, this vulnerability is not listed on the CISA Known Exploited Vulnerabilities (KEV) catalog and no public exploits are currently available.
What versions of MySQL are affected by CVE-2026-60186?
MySQL Server versions 8.4.0 through 8.4.10 and 9.7.0 through 9.7.1 are affected, as well as MySQL Cluster 8.0.0-8.0.47, 8.4.0-8.4.10, and 9.7.0-9.7.1.
How do I check if my server is vulnerable to CVE-2026-60186?
Run 'mysql --version' and compare against the affected ranges. If running 8.4.0-8.4.10 or 9.7.0-9.7.1, and Group Replication is enabled, your instance is vulnerable.
What authentication is required to exploit this vulnerability?
The attacker requires high-privilege (administrative) credentials and network access to the MySQL server, making opportunistic exploitation unlikely but serious for compromised admin accounts.
Does Defensia detect CVE-2026-60186?
Yes — Defensia's CVE advisory scanner compares installed package versions against the NVD database. If MySQL is installed on a monitored server, CVE-2026-60186 will appear in your dashboard with remediation steps.
Related MySQL CVEs
References
Track CVEs across your fleet automatically
Defensia scans your Linux servers and tells you exactly which ones are running vulnerable versions — including CVE-2026-60186. Free for 1 server.
Get started free