USN-8700-1: MySQL vulnerabilities
Multiple security issues were discovered in MySQL. MySQL has been updated to 8.4.11 in Ubuntu 26.04 LTS. Ubuntu 22.04 LTS and Ubuntu 24.04 LTS packages have been updated with backported patches. In addition to security fixes, the updated packages contain bug fixes, new features, and possibly incompatible changes. Please see the following for more information: https://dev.mysql.com/doc/relnotes/mysql/8.4/en/news-8-4-11.html https://www.oracle.com/security-alerts/cpujul2026.html
CSIRTS triage
- What
- Multiple unspecified security issues were discovered in MySQL requiring a major version update.
- Who is affected
- All users and deployments running MySQL on Ubuntu 22.04 LTS, 24.04 LTS, and 26.04 LTS.
- Urgency
- High urgency; multiple security issues in a critical database component affecting all supported Ubuntu versions.
- Action
- Update MySQL to version 8.4.11 or apply the backported patches per USN-8700-1 and Oracle CPU July 2026.
AI-assisted analysis generated from the source advisory — verify against the original.
⚡ Watch MySQL
Get an email when a new MySQL advisory drops — max one per day, one-click unsubscribe.
Details
Original advisory: https://ubuntu.com/security/notices/USN-8700-1
Exploitation outlook
EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.
- Low exploitation riskCVE-2026-611090.42% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 35% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-610960.19% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 8% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-610940.47% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 39% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-610810.26% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 18% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-607470.19% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 9% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-605850.36% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 29% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-603320.20% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 10% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-603310.20% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 10% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-603160.38% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 31% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-603150.27% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 20% of all EPSS-scored CVEs.
Referenced CVEs
Same CVEs, other sources
How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.
- high[NEW] [high] Oracle MySQL: Multiple vulnerabilitiescert-bund
- unknownMultiple vulnerabilities in Oracle MySQL (July 23, 2026)cert-fr-avis
- unknownNCSC-2026-0262 [1.00] [M/H] Vulnerabilities fixed in Oracle MySQL Server and MySQL Clusterncsc-nl
- mediumCVE-2026-61109: Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: J…nvd
- lowCVE-2026-61096: Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: P…nvd
- highCVE-2026-61094: Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: R…nvd
- lowCVE-2026-61081: Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: P…nvd
- mediumCVE-2026-60747: Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: R…nvd
- mediumCVE-2026-60585: Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: R…nvd
- mediumCVE-2026-60332: Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: G…nvd
- mediumCVE-2026-60331: Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: R…nvd
- highCVE-2026-60316: Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: X…nvd
More from Ubuntu Security Notices
- unknownUSN-8571-2: Apache HTTP Server regression2026-09-10
- unknownUSN-8747-1: Beets vulnerability2026-09-10
- unknownUSN-8746-1: libEBML vulnerability2026-09-10
- unknownUSN-8745-1: KissFFT vulnerabilities2026-09-10
- unknownUSN-8748-1: Linux kernel (NVIDIA) vulnerabilities2026-09-10