Description
Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/Net). The supported version that is affected is 26.7.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Connectors. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized read access to a subset of MySQL Connectors accessible data. CVSS 3.1 Base Score 4.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N).
Published: 2026-10-20
Score: 4.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Unauthorized Read Access to MySQL Connector Data
Action: Apply Update
AI Analysis

Impact

An unauthenticated attacker who can reach the MySQL Connector/Net 26.7.0 component over the network can trigger a flaw that, with the help of a human user other than the attacker, leads to unauthorized read access to a limited portion of the data exposed by the connector. The vulnerability affects confidentiality only, as indicated by the CVSS vector, and does not impact integrity or availability.

Affected Systems

Oracle Corporation’s MySQL Connectors product, specifically the Connector/Net 26.7.0 release. No other versions or products are listed as affected.

Risk and Exploitability

The CVSS score of 4.3 places this vulnerability in the low‑moderate range for confidentiality risk, and no EPSS data is available, so the exploitation probability is unclear. The vulnerability is not included in CISA’s KEV catalog. It requires network access and user interaction from someone other than the attacker, which reduces the likelihood that any remote attacker will be able to exercise the flaw against a target that has not been compromised by a separate social‑engineering or physical attack.

Generated by OpenCVE AI on October 21, 2026 at 04:42 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade MySQL Connector/Net to a version that contains the vendor patch
  • If upgrading is not immediately possible, restrict network exposure of the connector by using firewall rules or network segmentation so only trusted hosts can reach its ports
  • Ensure that all interfaces of the connector require proper authentication and disable any anonymous or default access that could allow unauthenticated read

Generated by OpenCVE AI on October 21, 2026 at 04:42 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 23 Oct 2026 00:45:00 +0000

Type Values Removed Values Added
First Time appeared Oracle mysql Connector/net
Vendors & Products Oracle mysql Connector/net

Wed, 21 Oct 2026 19:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 21 Oct 2026 05:00:00 +0000

Type Values Removed Values Added
Title Unauthenticated Network Attack Permitting Unauthorized Read Access to Oracle MySQL Connector/Net 26.7.0 Data
Weaknesses CWE-284

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/Net). The supported version that is affected is 26.7.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Connectors. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized read access to a subset of MySQL Connectors accessible data. CVSS 3.1 Base Score 4.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N).
First Time appeared Oracle
Oracle mysql Connector\/net
CPEs cpe:2.3:a:oracle:mysql_connector\/net:26.7.0:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle mysql Connector\/net
References
Metrics cvssV3_1

{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N'}

Subscriptions

Oracle Mysql Connector/net Mysql Connector\/net
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-10-21T18:36:55.655Z

Reserved: 2026-09-28T15:40:09.496Z

Link: CVE-2026-101625

cve-icon Vulnrichment

Updated: 2026-10-21T18:19:31.432Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-20T22:18:16.500

Modified: 2026-10-21T19:16:51.047

Link: CVE-2026-101625

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-22T23:30:13Z

Weaknesses