CVE-2026-60586: Access Vulnerability in MySQL Connector/J

CVE-2026-60586 is a vulnerability in the Connector/J component of Oracle MySQL Connectors. The flaw allows a low-privileged attacker with network access to acquire sensitive data through multiple protocols. The defect exhibits a scope change: impact extends beyond the connector itself, potentially compromising access to all data managed through the affected component. Vulnerable versions are 9.7.0 and 9.7.1.

Severity is rated CVSS 7.7 (high). The vulnerability was officially disclosed by NVD on July 21, 2026. As a recent signal, as of November 6, 2026, public repositories on GitHub declare containing material related to this flaw: this does not confirm active exploitation in the field, but highlights that the topic remains subject to research and community attention. Patch status is not currently reported in official data.

For defenses: 1) Immediately inventory MySQL Connector/J installations in version 9.7.0 or 9.7.1 in production and development environments. 2) Verify whether a patch or new version is available from Oracle. 3) Prioritize testing and deployment of the update, given the impact on critical data. 4) In the interim, if possible, restrict privileges of accounts used by connectors and limit network access to essential resources only.