CVE-2026-60331

What it actually does

Flaw in MySQL Server replication component allows a high-privileged local attacker to escalate privileges and achieve full server takeover.

Why it matters to the business

Successful exploitation can result in complete compromise of database servers, leading to data theft, tampering, or service disruption; the affected MySQL versions are widely deployed, increasing exposure across many environments.

How an attack unfolds

An attacker with administrative access to the host running an affected MySQL instance leverages the replication vulnerability through local interaction to bypass security controls and obtain full control over the database process.

How to fix it

Upgrade MySQL Server and Cluster to fixed versions: 8.4.11 or later for 8.4.x series and 9.7.2 or later for 9.7.x series. For Red Hat packages apply mysql8.4-8.4.11-1.el10_2 or newer via RHSA-2026:56007.

How to confirm the fix worked

Verify installed MySQL version against the fixed releases listed in vendor advisories; review replication configuration and apply latest security patches; re-test connectivity and privileges after upgrade.

Typical attack path

1. Obtain high-privileged local access to the MySQL host
2. Trigger the replication flaw via crafted local operations
3. Escalate privileges to gain control of the MySQL server process
4. Perform unauthorized actions such as data exfiltration or persistence

How to detect it

Review authentication and process execution logs on database hosts for unexpected replication-related activity or privilege changes by administrative users; examine audit logs for anomalous takeover indicators post-authentication.

What your security team should do

• Prioritize patching MySQL instances to the specified fixed versions within standard change windows
• Restrict local administrative access to database hosts to the minimum necessary personnel
• Monitor EPSS trend and re-evaluate risk if exploit maturity increases