Description
Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: InnoDB). Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and 26.7.0-26.7.1. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where MySQL Server, MySQL Cluster executes to compromise MySQL Server, MySQL Cluster. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).
Published: 2026-10-20
Score: 4.4 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service
Action: Immediate Patch
AI Analysis

Impact

The vulnerability resides in the InnoDB storage engine of MySQL Server and MySQL Cluster. An attacker with local high privileges on the host can trigger an incident by executing privileged commands that cause the database process to hang or crash, resulting in a denial of service that prevents all client connections until the service is restarted or the host is powered back on.

Affected Systems

Affected products are Oracle MySQL Server versions 8.4.0‑8.4.12, 9.7.0‑9.7.3, and 26.7.0‑26.7.1, and Oracle MySQL Cluster versions 8.0.0‑8.0.49, 8.4.0‑8.4.12, 9.7.0‑9.7.3, and 26.7.0‑26.7.1. These version ranges were identified by Oracle as vulnerable to this issue.

Risk and Exploitability

The CVSS base score of 4.4 indicates a low‑to‑moderate severity for availability, with local access, low attack complexity, and high privilege required. No evidence of field‑of‑view exploitation is available; EPSS data is missing, and the vulnerability is not listed in CISA’s KEV catalog. Because the vector requires a local, high privilege account, the risk to a system that strictly controls local access is lower than that of a remote attack, but any compromised account with database administrative rights can bring the service down.

Generated by OpenCVE AI on October 21, 2026 at 04:46 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply Oracle’s latest security patch for MySQL Server and MySQL Cluster that addresses the InnoDB issue, and restart the database services.
  • If an immediate patch cannot be applied, install Oracle’s October 2026 security patch for the InnoDB component and restart the database services.
  • Limit local administrative access to the database host, ensuring only trusted accounts run the MySQL processes; consider moving the database to an isolated environment with strict least‑privilege controls.

Generated by OpenCVE AI on October 21, 2026 at 04:46 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 05 Nov 2026 17:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 23 Oct 2026 00:45:00 +0000

Type Values Removed Values Added
Title Local Privileged DoS via InnoDB in MySQL Server and Cluster mysql: mysql: Denial of service in InnoDB
References
Metrics threat_severity

None

 threat_severity

Moderate

Wed, 21 Oct 2026 05:15:00 +0000

Type Values Removed Values Added
Title Local Privileged DoS via InnoDB in MySQL Server and Cluster
Weaknesses CWE-400

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: InnoDB). Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and 26.7.0-26.7.1. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where MySQL Server, MySQL Cluster executes to compromise MySQL Server, MySQL Cluster. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).
First Time appeared Oracle
Oracle mysql Cluster
Oracle mysql Server
CPEs cpe:2.3:a:oracle:mysql_cluster:*:*:*:*:*:*:*:*
cpe:2.3:a:oracle:mysql_server:*:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle mysql Cluster
Oracle mysql Server
References
Metrics cvssV3_1

{'score': 4.4, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H'}

Subscriptions

Oracle Mysql Cluster Mysql Server
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-11-05T15:57:10.485Z

Reserved: 2026-09-28T15:40:09.495Z

Link: CVE-2026-101615

cve-icon Vulnrichment

Updated: 2026-11-05T15:56:38.779Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-20T22:18:15.353

Modified: 2026-11-05T16:17:23.183

Link: CVE-2026-101615

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-10-20T21:21:54Z

Links: CVE-2026-101615 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-10-22T17:00:09Z

Weaknesses
  • CWE-400

    Uncontrolled Resource Consumption