CVE-2026-61081

Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Performance Schema). Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and 9.7.0-9.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster. Successful attacks of this vulnerability can result in unauthorized read access to a subset of MySQL Server, MySQL Cluster accessible data. CVSS 3.1 Base Score 2.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N).

CVSS v3 2.7 LOW

2.7^/10

CVSS v3 : LOW

Vector :

Exploitability : 1.2 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://www.oracle.com/security-alerts/cpujul2026.html	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:oracle:mysql_server::::::::
	cpe:2.3:a:oracle:mysql_server:9.7.0:::::::*
	cpe:2.3:a:oracle:mysql_server:9.7.1:::::::*

Configuration 2 (hide)

OR	cpe:2.3:a:oracle:mysql_cluster::::::::
	cpe:2.3:a:oracle:mysql_cluster::::::::
	cpe:2.3:a:oracle:mysql_cluster:9.7.0:::::::*
	cpe:2.3:a:oracle:mysql_cluster:9.7.1:::::::*

History

No history.

Information

Published : 2026-07-21 22:18

Updated : 2026-07-27 17:49

NVD link : CVE-2026-61081

Mitre link : CVE-2026-61081

CVE.ORG link : CVE-2026-61081

JSON object : View

Products Affected

oracle

mysql_server
mysql_cluster

CWE

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

{"id": "CVE-2026-61081", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-61081", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-23T19:13:44.855848Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "secalert_us@oracle.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 2.7, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 1.2}]}, "affected": [{"source": "secalert_us@oracle.com", "affectedData": [{"vendor": "Oracle Corporation", "product": "MySQL Server", "versions": [{"status": "affected", "version": "8.4.0-8.4.10"}, {"status": "affected", "version": "9.7.0-9.7.1"}]}, {"vendor": "Oracle Corporation", "product": "MySQL Cluster", "versions": [{"status": "affected", "version": "8.0.0-8.0.47"}, {"status": "affected", "version": "8.4.0-8.4.10"}, {"status": "affected", "version": "9.7.0-9.7.1"}]}]}], "published": "2026-07-21T22:18:38.980", "references": [{"url": "https://www.oracle.com/security-alerts/cpujul2026.html", "tags": ["Vendor Advisory"], "source": "secalert_us@oracle.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-200"}]}], "descriptions": [{"lang": "en", "value": "Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Performance Schema). Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and 9.7.0-9.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster. Successful attacks of this vulnerability can result in unauthorized read access to a subset of MySQL Server, MySQL Cluster accessible data. CVSS 3.1 Base Score 2.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N)."}], "lastModified": "2026-07-27T17:49:51.677", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:oracle:mysql_server:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "20500A3C-1C84-4B5D-B46A-B74DF54640BD", "versionEndIncluding": "8.4.10", "versionStartIncluding": "8.4.0"}, {"criteria": "cpe:2.3:a:oracle:mysql_server:9.7.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A65991A5-C5F6-4C62-AF5A-BE5C0370EF7C"}, {"criteria": "cpe:2.3:a:oracle:mysql_server:9.7.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "CC5CA0F1-FEF9-4DA8-B867-E9EF20A58512"}], "operator": "OR"}]}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:oracle:mysql_cluster:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "AD39D6D1-36B9-403D-A8BD-3480AE92E9E7", "versionEndIncluding": "8.0.47", "versionStartIncluding": "8.0.0"}, {"criteria": "cpe:2.3:a:oracle:mysql_cluster:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E6FD5365-6FD2-412C-B844-F0D29A9DD757", "versionEndIncluding": "8.4.10", "versionStartIncluding": "8.4.0"}, {"criteria": "cpe:2.3:a:oracle:mysql_cluster:9.7.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D804257D-F6E5-462B-AF71-48738704F36A"}, {"criteria": "cpe:2.3:a:oracle:mysql_cluster:9.7.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A9B75B87-48CD-4224-A585-E4D75492C5DB"}], "operator": "OR"}]}], "sourceIdentifier": "secalert_us@oracle.com"}