CVE-2026-60623: Oracle MySQL Connector/J Vulnerability

CVE-2026-60623 is a vulnerability in MySQL Connector/J (Oracle MySQL component) affecting versions 9.7.0 and 9.7.1. The flaw allows a network attacker with low-level privileges to compromise data confidentiality and integrity by modifying, deleting, or creating critical data in environments using this connector. Impacts include unauthorized access to MySQL Connectors data and partial denial of service against the service.

The CVSS 3.1 Base Score is 7.1, classified as HIGH. Although the vulnerability is difficult to exploit (AC:H), impacts are significant on confidentiality, integrity, and availability. The CVE was published by the National Vulnerability Database on July 21, 2026. A critical signal comes from public repositories on GitHub where, as of November 6, 2026, related exploits have been reported: this transforms the risk from theoretical to concrete for those who have not yet applied fixes.

Organizations and IT administrators must first identify systems running MySQL Connector/J 9.7.0 or 9.7.1, particularly in Java environments and applications connecting to MySQL databases. Contact Oracle to verify availability of official patches and release timelines. In absence of patches, evaluate mitigations such as restricting network access to the connector from trusted hosts only and reducing privileges of users accessing data. Patch application should be prioritized given the public exploit availability reported in November 2026.