Description
Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/Net). The supported version that is affected is 26.7.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Connectors. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all MySQL Connectors accessible data. CVSS 3.1 Base Score 5.9 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N).
Published: 2026-10-20
Score: 5.9 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Confidentiality breach via unauthenticated network access
Action: Patch
AI Analysis

Impact

A flaw in Oracle MySQL Connector/Net version 26.7.0 lets an attacker who is not authenticated gain access to the connector over the network, allowing that attacker to read all data exposed by the connector. The vulnerability is rated CVSS 3.1 score 5.9 and carries a confidentiality impact with no impact on integrity or availability.

Affected Systems

The vulnerability affects Oracle Corporation’s MySQL Connector/Net product, specifically version 26.7.0. Only this release is documented as compromised; other installed connector versions are not impacted under the current advisory.

Risk and Exploitability

The exploit requires only network connectivity to the affected connector instance and does not need prior authentication or elevated privileges. While the EPSS score is not available, the CVSS score of 5.9 reflects a moderate level of risk, and the vulnerability is not listed in CISA’s KEV catalog. The attack vector is via network protocols supported by the connector, suggesting that exposure to untrusted networks can enable a data breach.

Generated by OpenCVE AI on October 21, 2026 at 00:31 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply Oracle’s official patch or upgrade to the latest MySQL Connector/Net release that removes the vulnerability, referencing the October 2026 CPU advisory for details.
  • If an immediate patch is not feasible, restrict network access to the Connector/Net instance by configuring firewall rules or virtual network segmentation to allow only trusted hosts.
  • Enable logging and monitoring for unusual authentication or data retrieval activity on the connector to detect potential exploitation attempts promptly.

Generated by OpenCVE AI on October 21, 2026 at 00:31 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 23 Oct 2026 00:45:00 +0000

Type Values Removed Values Added
First Time appeared Oracle mysql Connector/net
Vendors & Products Oracle mysql Connector/net

Wed, 21 Oct 2026 19:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 21 Oct 2026 01:00:00 +0000

Type Values Removed Values Added
Title Unauthenticated Network Access Grants Remote Data Read in Oracle MySQL Connector/Net 26.7.0
Weaknesses CWE-284

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/Net). The supported version that is affected is 26.7.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Connectors. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all MySQL Connectors accessible data. CVSS 3.1 Base Score 5.9 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N).
First Time appeared Oracle
Oracle mysql Connector\/net
CPEs cpe:2.3:a:oracle:mysql_connector\/net:26.7.0:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle mysql Connector\/net
References
Metrics cvssV3_1

{'score': 5.9, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N'}

Subscriptions

Oracle Mysql Connector/net Mysql Connector\/net
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-10-21T18:36:46.984Z

Reserved: 2026-09-28T15:40:09.496Z

Link: CVE-2026-101626

cve-icon Vulnrichment

Updated: 2026-10-21T18:19:32.984Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-20T22:18:16.610

Modified: 2026-10-21T19:16:51.167

Link: CVE-2026-101626

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-22T23:30:13Z

Weaknesses