CVE-2026-61096: 
MySQL vulnerability analysis and mitigation

CVE-2026-61096 is an improper access control vulnerability in the Pluggable Auth component of Oracle MySQL Server and MySQL Cluster. It was disclosed on July 21, 2026, as part of Oracle's Critical Patch Update (CPUJul2026). Affected versions include MySQL Server 8.4.0–8.4.10 and 9.7.0–9.7.1, and MySQL Cluster 8.0.0–8.0.47, 8.4.0–8.4.10, and 9.7.0–9.7.1. The vulnerability carries a CVSS v3.1 base score of 2.9 (Low severity) (Oracle Advisory).

The vulnerability is classified as CWE-284 (Improper Access Control) and resides in the Server: Pluggable Auth component of MySQL Server and MySQL Cluster (Oracle Advisory). The attack vector is local (AV:L), meaning an attacker must have logon access to the infrastructure where MySQL Server or MySQL Cluster executes. Exploitation is rated as difficult (AC:H), requires no privileges (PR:N), and no user interaction. No public proof-of-concept or detailed technical write-up has been identified at this time.

Successful exploitation allows an unauthenticated local attacker to perform unauthorized update, insert, or delete operations on a subset of data accessible within the MySQL Server or MySQL Cluster instance. The impact is limited to integrity — there is no confidentiality or availability impact. The scope is unchanged, meaning the vulnerability does not enable lateral movement beyond the affected database component (Oracle Advisory).

There is no evidence of public proof-of-concept code or active in-the-wild exploitation of CVE-2026-61096. The EPSS score is approximately 0.00124 (very low probability of exploitation), and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The NVD SSVC assessment confirms exploitation status as "none" and the vulnerability is not automatable (Oracle Advisory).

Oracle has released patches for this vulnerability as part of the July 2026 Critical Patch Update (CPUJul2026). Administrators should apply the available security patches for affected MySQL Server versions (8.4.0–8.4.10, 9.7.0–9.7.1) and MySQL Cluster versions (8.0.0–8.0.47, 8.4.0–8.4.10, 9.7.0–9.7.1) immediately. As a temporary measure, restrict local logon access to the infrastructure hosting MySQL Server and MySQL Cluster to authorized personnel only, and implement strong access controls and monitoring for local system access (Oracle Advisory).