Description
Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Client programs). Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and 26.7.0-26.7.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster. Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).
Published: 2026-10-20
Score: 8.1 High
EPSS: < 1% Very Low
KEV: No
Impact: Remote Code Execution
Action: Immediate Patch
AI Analysis

Impact

This vulnerability in the Client programs of Oracle MySQL allows an unauthenticated attacker with network access via multiple protocols to take over a MySQL Server or MySQL Cluster, potentially gaining full control and compromising the confidentiality, integrity, and availability of the database system.

Affected Systems

Oracle Corporation’s MySQL Server and MySQL Cluster are affected. Vulnerable versions include MySQL Server 8.4.0 through 8.4.12, 9.7.0 through 9.7.3, and 26.7.0 through 26.7.1, as well as MySQL Cluster 8.0.0 through 8.0.49, 8.4.0 through 8.4.12, 9.7.0 through 9.7.3, and 26.7.0 through 26.7.1.

Risk and Exploitability

The CVSS base score is 8.1, indicating a high severity with impacts to all CIA triad aspects. The EPSS score is less than 1%, reflecting a very low but nonzero exploitation probability, and the vulnerability is not listed in the CISA KEV catalog. Though the description notes the exploit is difficult, the required conditions—unauthenticated network access across multiple protocols—are commonly present on exposed MySQL services, making the risk significant for organizations that have these versions deployed without segmentation or restriction.

Generated by OpenCVE AI on October 23, 2026 at 06:16 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the latest MySQL Server patch or upgrade to a version newer than 8.4.12, 9.7.3, or 26.7.1.
  • Upgrade MySQL Cluster to a version newer than 8.0.49, 8.4.12, 9.7.3, or 26.7.1.
  • Configure firewalls or network segmentation to restrict external access to MySQL services and enforce secure connection protocols.

Generated by OpenCVE AI on October 23, 2026 at 06:16 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Ubuntu USN Ubuntu USN USN-9046-1 MySQL vulnerabilities
History

Tue, 10 Nov 2026 21:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Fri, 23 Oct 2026 05:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-287

Fri, 23 Oct 2026 00:45:00 +0000

Type Values Removed Values Added
Title mysql: mysql: unauthorized server takeover
Weaknesses CWE-20
References
Metrics threat_severity

None

 threat_severity

Important

Thu, 22 Oct 2026 18:15:00 +0000

Type Values Removed Values Added
Title Unauthenticated Network Exploit Enables Full MySQL Server and Cluster Compromise

Thu, 22 Oct 2026 16:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-284

Wed, 21 Oct 2026 03:00:00 +0000

Type Values Removed Values Added
Title Unauthenticated Network Exploit Enables Full MySQL Server and Cluster Compromise
Weaknesses CWE-287

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Client programs). Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and 26.7.0-26.7.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster. Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).
First Time appeared Oracle
Oracle mysql Cluster
Oracle mysql Server
CPEs cpe:2.3:a:oracle:mysql_cluster:*:*:*:*:*:*:*:*
cpe:2.3:a:oracle:mysql_server:*:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle mysql Cluster
Oracle mysql Server
References
Metrics cvssV3_1

{'score': 8.1, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Oracle Mysql Cluster Mysql Server
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-10-22T15:16:53.753Z

Reserved: 2026-09-28T15:40:09.505Z

Link: CVE-2026-101772

cve-icon Vulnrichment

Updated: 2026-10-22T15:12:24.267Z

cve-icon NVD

Status : Analyzed

Published: 2026-10-20T22:18:32.640

Modified: 2026-10-29T16:27:49.607

Link: CVE-2026-101772

cve-icon Redhat

Severity : Important

Publid Date: 2026-10-20T21:22:50Z

Links: CVE-2026-101772 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-10-23T06:30:07Z

Weaknesses
  • CWE-20

    Improper Input Validation

  • CWE-284

    Improper Access Control