CVE-2026-60163: MySQL Group Replication unauthenticated remote arbitrary SQL execution
Oracle reclassified MySQL Group Replication flaw CVE-2026-60163 from Local to Adjacent Network; researcher says it enables unauthenticated remote arbitrary SQL execution.
CVE-2026-60163 in MySQL Group Replication permits an unauthenticated remote attacker to execute arbitrary SQL on the destination server. Following discussion after the July disclosure, Oracle revised the CVSS attack vector rating from 'Local' to 'Adjacent Network'. The researcher posting to oss-security clarifies that, in the extreme, the attack surface is reachable fully remotely.
- Unauthenticated attacker can execute arbitrary SQL on target
- Oracle changed attack vector rating from Local to Adjacent Network
- Researcher argues the flaw can be reachable fully remotely
- Disclosed in July 2026, shared belatedly in September
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-60163 | Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component | 8.4 | <1% |
From the original article
Posted by manizada on Sep 14 Hi folks, Sharing (belatedly) the July disclosure of the MySQL CVE-2026-60163 + an update on its reclassification. The vulnerability permits an unauthenticated remote attacker to execute arbitrary SQL on the destination. Following discussion, Oracle revised the attack vector rating from 'Local' to 'Adjacent Network'.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.