CVE-2026-60315·MySQL vulnerability

How likely is exploitation

FIRST's Exploit Prediction Scoring System puts the probability of this CVE being exploited in the next 30 days at 0.25% — higher than 17% of all published CVEs. EPSS is an independent forecast of exploitation, not a severity rating: it says nothing about how much damage a successful attack does, which is what a CVSS score measures.

Read the two together. CVE-2026-60315 scores 8.2 on CVSS, so a successful attack would be serious — but at 0.25%, almost nobody is currently attempting it. That is a different situation from a flaw under mass exploitation, and it is usually the difference between patching on your next maintenance window and patching tonight.

Affected versions

How to fix this CVE

Update MySQL Server immediately to version 8.0.46 or later to patch the X Plugin vulnerability that allows remote attackers to trigger denial-of-service conditions and read sensitive data without authentication. Apply the update through your distribution's package manager, then restart the MySQL service to ensure the patched code is loaded. Verify the updated version is running before returning the system to production.

sudo dnf update mysql-server && sudo systemctl restart mysqld

What an exploitation attempt looks like

Sample log line indicative of exploitation attempts:

POST|GET requests to port 33060 (X Protocol) or 3306 (MySQL) from external IPs with malformed authentication packets; MySQL error logs showing 'X Protocol' errors followed by connection resets or crashes; patterns: 'Connection refused on X Protocol', 'Aborted connection', 'Fatal signal 11' in mysqld error log.

How to check if you are affected

1. Run `mysql --version` or `SELECT VERSION();` in the MySQL client to check your installed version against the vulnerable ranges (8.4.0-8.4.10, 9.7.0-9.7.1, or 8.0.0-8.0.47 for Cluster).
2. Verify that the X Plugin is enabled by checking the MySQL configuration file `/etc/mysql/mysql.conf.d/mysqld.cnf` or running `SHOW PLUGINS;` to confirm `mysqlx` is listed.
3. Search MySQL error logs (typically `/var/log/mysql/error.log`) for unexpected connection attempts, protocol errors, or crashes with patterns like 'X Protocol', 'mysqlx_port', or segmentation fault messages.
4. After patching, confirm the update with `mysql --version` and verify the service restarted cleanly by checking `sudo systemctl status mysql` or `sudo systemctl status mysqld` for any startup errors.

FAQ

Related MySQL CVEs

References

• https://www.oracle.com/security-alerts/cpujul2026.html