Description
Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General). Supported versions that are affected are 26.7.0-26.7.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via TCP to compromise MySQL Cluster. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Cluster as well as unauthorized update, insert or delete access to some of MySQL Cluster accessible data and unauthorized read access to a subset of MySQL Cluster accessible data. CVSS 3.1 Base Score 7.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H).
Published: 2026-10-20
Score: 7 High
EPSS: n/a
KEV: No
Impact: Denial of Service and Unauthorized Data Manipulation
Action: Immediate Patch
AI Analysis

Impact

The vulnerability resides in the Oracle MySQL Cluster component 'Cluster: General'. An unauthenticated attacker with network access via TCP can exploit a flaw that may cause the cluster to hang or crash repeatedly, resulting in a denial of service, and gain unauthorized update, insert or delete rights to some accessible data, while also reading a subset of data. The flaw permits Confidentiality and Integrity compromise at a low level and a high impact on Availability.

Affected Systems

The affected product is Oracle MySQL Cluster, specifically the versions 26.7.0 through 26.7.1. These releases contain the vulnerability in the Cluster: General component. No other component versions are currently known to be affected.

Risk and Exploitability

With a CVSS v3.1 Base Score of 7.0 the vulnerability is considered high severity. The EPSS score is not available, and the vulnerability has not been listed in CISA’s KEV catalog. The likely attack vector is a network‑based attack over TCP, where an unauthenticated attacker can remotely trigger the denial of service or data modification. Because availability is wholly impacted an attacker could disrupt critical services; confidentiality and integrity attacks could lead to data loss or tampering.

Generated by OpenCVE AI on October 21, 2026 at 01:31 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the latest Oracle patch or upgrade to a non‑affected version of MySQL Cluster
  • Restrict inbound TCP access to the MySQL Cluster by configuring firewall rules or network segmentation to limit connections to trusted hosts
  • Monitor MySQL Cluster logs and performance metrics for repeated crashes or unusual data write operations and alert administrators to any anomalies

Generated by OpenCVE AI on October 21, 2026 at 01:31 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 21 Oct 2026 02:00:00 +0000

Type Values Removed Values Added
Title Unauthenticated Remote DoS and Data Manipulation via MySQL Cluster
Weaknesses CWE-284

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General). Supported versions that are affected are 26.7.0-26.7.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via TCP to compromise MySQL Cluster. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Cluster as well as unauthorized update, insert or delete access to some of MySQL Cluster accessible data and unauthorized read access to a subset of MySQL Cluster accessible data. CVSS 3.1 Base Score 7.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H).
First Time appeared Oracle
Oracle mysql Cluster
CPEs cpe:2.3:a:oracle:mysql_cluster:*:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle mysql Cluster
References
Metrics cvssV3_1

{'score': 7, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H'}

Subscriptions

Oracle Mysql Cluster
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-10-20T21:22:49.311Z

Reserved: 2026-09-28T15:40:09.505Z

Link: CVE-2026-101769

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-20T22:18:32.290

Modified: 2026-10-20T22:18:32.290

Link: CVE-2026-101769

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-21T01:45:14Z

Weaknesses