CVE-2026-60592: 
MySQL Cluster vulnerability analysis and mitigation

CVE-2026-60592 is a vulnerability in the MySQL Cluster product of Oracle MySQL, specifically affecting the Cluster: NDB Operator component. It allows unauthenticated attackers with network access to cause a denial of service (hang or frequently repeatable crash) and perform unauthorized data modification (update, insert, or delete) on MySQL Cluster data. Affected versions include 8.0.0–8.0.47, 8.4.0–8.4.10, and 9.7.0–9.7.1. The vulnerability was disclosed and patched on August 18, 2026, as part of Oracle's Critical Security Patch Update. It carries a CVSS v3.1 base score of 8.2 (High) (Oracle Advisory).

The vulnerability resides in the NDB Operator component of MySQL Cluster and is exploitable over multiple network protocols without authentication or user interaction, indicating a flaw in how the NDB Operator handles incoming network requests (consistent with CWE-400: Uncontrolled Resource Consumption or improper input handling). The attack vector is network-based with low complexity, requiring no privileges, making it trivially exploitable by any attacker with network access to the MySQL Cluster service. Oracle has not publicly disclosed the precise root cause or technical mechanism, and no public proof-of-concept code has been identified (Oracle Advisory).

Successful exploitation can result in a complete denial of service of the MySQL Cluster through a hang or frequently repeatable crash, as well as unauthorized modification (update, insert, or delete) of data accessible via MySQL Cluster. There is no confidentiality impact reported, meaning data exfiltration is not a direct consequence. However, the combination of service disruption and data integrity compromise poses significant operational risk for environments relying on MySQL Cluster for high-availability database workloads (Oracle Advisory).

There is no public proof-of-concept exploit code and no evidence of active in-the-wild exploitation as of the disclosure date. The EPSS score is reported at 0.0, reflecting low current exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Despite the absence of known exploits, the low attack complexity and lack of authentication requirements make this vulnerability a high-priority patching target (Oracle Advisory).

Oracle released patches for this vulnerability on August 18, 2026, as part of the August 2026 Critical Security Patch Update. Users should upgrade MySQL Cluster to versions beyond 8.0.47 (for the 8.0.x branch), 8.4.10 (for the 8.4.x branch), or 9.7.1 (for the 9.7.x branch). As a temporary workaround, Oracle recommends restricting network access to MySQL Cluster services to trusted hosts only and implementing network segmentation to reduce exposure to unauthenticated attackers, though these measures do not address the underlying vulnerability (Oracle Advisory).