CVE-2026-60569CWE-306

CVE-2026-60569

Medium · published July 22, 2026

CVSS v3.1
5.1
EPSS
0%
Percentile
3.6
In the wild
Unconfirmed
What it is

Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: NDB Operator). Supported versions that are affected are 8.0.0-8.0.47, 8.4.0-8.4.10 and 9.7.0-9.7.1. Difficult to exploit vulnerability allows unauthenticated attacker with logon to the infrastructure where MySQL Cluster executes to compromise MySQL Cluster. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all MySQL Cluster accessible data. CVSS 3.1 Base Score 5.1 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N).

The record
Technical detail
CVSS v3.1
5.1 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00147 · 3.6th percentile
Weakness
CWE-306 · Missing Authentication for Critical Function
Published
2026-07-22T02:17Z
Affected products (4)
ProductVersionsFixed in
oracle/mysql_cluster≥ 8.0.0, ≤ 8.0.47—
oracle/mysql_cluster≥ 8.4.0, ≤ 8.4.10—
oracle/mysql_clusterall versions—
oracle/mysql_clusterall versions—
References (1)
https://www.oracle.com/security-alerts/cpujul2026.html · [email protected]
EPSS history
Timeline
  • 21 JUL 21:35Z
    Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: NDB Operator)
    cvelistv5