High severity · published Jul 21, 2026
CVE-2026-60725
Vulnerability in the MySQL Router product of Oracle MySQL (component: Router: General)
7.4
CVSS
0.3%
EPSS
No
On KEV
Description
Vulnerability in the MySQL Router product of Oracle MySQL (component: Router: General). Supported versions that are affected are 8.4.0-8.4.10 and 9.7.0-9.7.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise MySQL Router. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all MySQL Router accessible data as well as unauthorized access to critical data or complete access to all MySQL Router accessible data. CVSS 3.1 Base Score 7.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N).
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 27% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MR
MySQL Router · Oracle Corporation
8.4.0 through 8.4.10; 9.7.0 through 9.7.1 · source: vendor, NVD
Affected product
MR
MySQL Router
Oracle Corporation
More from MySQL Router
9.8
CVE-2026-46860
Vulnerability in the MySQL Router product of Oracle MySQL (component: Router: General)
7.5
CVE-2026-101810
Vulnerability in the MySQL Router product of Oracle MySQL (component: Router: General)
7.5
CVE-2026-60314
Vulnerability in the MySQL Router product of Oracle MySQL (component: Router: General)
7.5
CVE-2026-46862
Vulnerability in the MySQL Router product of Oracle MySQL (component: Router: General)
7.4
CVE-2026-101783
Vulnerability in the MySQL Router product of Oracle MySQL (component: Router: General)