CVE-2026-60585

What it actually does

A flaw in the Server: Replication component allows a high-privileged network attacker to achieve full takeover of the MySQL Server or Cluster instance.

Why it matters to the business

Successful exploitation grants complete control of database servers, enabling data theft, alteration, or denial of service in widely deployed enterprise database environments.

How an attack unfolds

A high-privileged attacker with network access authenticates via supported protocols and exploits the replication component weakness to escalate privileges and fully compromise the target MySQL Server or Cluster.

How to fix it

Upgrade affected MySQL Server and Cluster installations to fixed versions, such as mysql8.4 (redhat el10) 8.4.11-1.el10_2 or later releases that resolve the replication issue.

How to confirm the fix worked

Confirm the running MySQL version is outside the affected ranges (8.4.0-8.4.10 and 9.7.0-9.7.1) and validate that replication functions correctly after applying the patch.

Typical attack path

1. Obtain high-privileged network credentials for the MySQL instance
2. Connect to the server over multiple supported protocols
3. Trigger the replication component flaw to escalate privileges
4. Achieve full server or cluster takeover

How to detect it

Review MySQL error and general query logs for anomalous replication-related commands or privilege changes originating from administrative accounts; no public exploitation artifacts have been observed.

What your security team should do

• Apply the vendor-supplied updates to all affected MySQL 8.4 and 9.7 installations immediately
• Restrict network access to database ports to only trusted administrative sources
• Audit high-privileged accounts and replication configurations for unnecessary permissions