CVE-2026-60585·MySQL vulnerability
Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication). Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and 9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster. Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 6.6 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H).
- Severity
- medium
- Software
- MySQL
- Fixed in
- 8.0.46-0ubuntu0.22.04.4
- Published
How likely is exploitation
FIRST's Exploit Prediction Scoring System puts the probability of this CVE being exploited in the next 30 days at 0.35% — higher than 28% of all published CVEs. EPSS is an independent forecast of exploitation, not a severity rating: it says nothing about how much damage a successful attack does, which is what a CVSS score measures.
Affected versions
From: 8.4.0
Until: 8.4.10
Fixed in: 8.0.46-0ubuntu0.22.04.4
How to fix this CVE
Update MySQL Server to version 8.0.46 or later to patch the replication component vulnerability affecting high-privilege users. This fix addresses a network-exploitable flaw in the replication subsystem that could allow administrative attackers to compromise database integrity and availability. Apply the update immediately, especially if your MySQL instance handles replication traffic from untrusted networks or if you have multiple administrative users.
sudo dnf update mysql-serverDefensia detects this vulnerability
How to check if you are affected
- Step 1: Check the installed MySQL version with: mysql --version or mysql -u root -p -e 'SELECT VERSION();'
- Step 2: Verify if replication is enabled by querying: mysql -u root -p -e 'SHOW SLAVE STATUS\G;' or 'SHOW REPLICA STATUS\G;' (MySQL 8.0.22+)
- Step 3: Review MySQL error logs for unusual replication errors: tail -f /var/log/mysql/error.log and grep -i 'replication\|binlog\|relay'
- Step 4: After applying the patch, confirm the version upgrade with: mysql -u root -p -e 'SELECT VERSION();' and verify replication continues to function normally with 'SHOW REPLICA STATUS\G;'
FAQ
What is CVE-2026-60585?
This is a replication subsystem vulnerability in MySQL Server that allows high-privileged network attackers to compromise the database through multiple protocol vectors. The flaw specifically affects the replication component, potentially enabling unauthorized data modification or availability disruption.
Is CVE-2026-60585 being actively exploited?
No, CVE-2026-60585 is not currently listed in CISA's Known Exploited Vulnerabilities catalog and no public exploits are available. However, the high impact and network-exploitable nature warrant prioritized patching.
What versions of MySQL are affected by CVE-2026-60585?
MySQL Server versions 8.4.0 through 8.4.10, 9.7.0 through 9.7.1, and MySQL Cluster versions 8.0.0 through 8.0.47, 8.4.0 through 8.4.10, and 9.7.0 through 9.7.1 are vulnerable.
How do I check if my server is vulnerable to CVE-2026-60585?
Run: mysql -u root -p -e 'SELECT VERSION();' and compare your version against the affected ranges listed above. If your version falls within 8.4.0-8.4.10 or 9.7.0-9.7.1, your instance requires patching.
Does Defensia detect CVE-2026-60585?
Yes — Defensia's CVE advisory scanner compares installed package versions against the NVD database. If MySQL is installed on a monitored server, CVE-2026-60585 will appear in your dashboard with remediation steps.
Related MySQL CVEs
References
Track CVEs across your fleet automatically
Defensia scans your Linux servers and tells you exactly which ones are running vulnerable versions — including CVE-2026-60585. Free for 1 server.
Get started free