CVE-2026-60592CWE-284broken-access-control

CVE-2026-60592

High · published August 19, 2026

CVSS v3.1
8.2
EPSS
0%
Percentile
30.7
In the wild
Unconfirmed
What it is

Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: NDB Operator). Supported versions that are affected are 8.0.0-8.0.47, 8.4.0-8.4.10 and 9.7.0-9.7.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Cluster. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Cluster as well as unauthorized update, insert or delete access to some of MySQL Cluster accessible data. CVSS 3.1 Base Score 8.2 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H).

The record
Technical detail
CVSS v3.1
8.2 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
CVSS v4.0
Not supplied
EPSS
0.00379 · 30.7th percentile
Weakness
CWE-284 · Improper Access Control
Published
2026-08-19T01:16Z
Affected products (3)
ProductVersionsFixed in
oracle/mysql_cluster≥ 8.0.0, ≤ 8.0.48—
oracle/mysql_cluster≥ 8.4.0, ≤ 8.4.11—
oracle/mysql_cluster≥ 9.7.0, ≤ 9.7.2—
References (1)
https://www.oracle.com/security-alerts/cspuaug2026.html · [email protected]
EPSS history
Timeline
  • 18 AUG 20:58Z
    Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: NDB Operator)
    cvelistv5