Description
Vulnerability in the MySQL Router product of Oracle MySQL (component: Router: General). The supported version that is affected is 26.7.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTPS to compromise MySQL Router. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all MySQL Router accessible data as well as unauthorized access to critical data or complete access to all MySQL Router accessible data. CVSS 3.1 Base Score 7.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N).
Published: 2026-10-20
Score: 7.4 High
EPSS: < 1% Very Low
KEV: No
Impact: Unauthorized data modification and deletion within MySQL Router
Action: Patch Immediately
AI Analysis

Impact

The vulnerability resides in the Oracle MySQL Router component. If successfully exploited, an unauthenticated attacker who can reach the service over HTTPS can create, delete, or modify data exposed by the router. The impact is a loss of confidentiality and integrity of all data accessible through the router, while availability remains unaffected.

Affected Systems

Affected vendor is Oracle Corporation and product is MySQL Router, version 26.7.0.

Risk and Exploitability

The CVSS score is 7.4, indicating a high severity. EPSS is not available and the vulnerability is not listed in CISA KEV. The likely attack vector is remote network access over HTTPS, requiring no authentication. Given the high confidentiality and integrity impact and the ease of access, the risk to systems that expose MySQL Router to the network is significant.

Generated by OpenCVE AI on October 21, 2026 at 02:32 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the latest Oracle patch for MySQL Router 26.7.0 or upgrade to a fixed version
  • Configure firewall or network ACLs so only trusted hosts can reach the MySQL Router HTTPS interface
  • Disable unused management interfaces and monitor access logs for suspicious activity

Generated by OpenCVE AI on October 21, 2026 at 02:32 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 21 Oct 2026 03:00:00 +0000

Type Values Removed Values Added
Title Unauthenticated HTTPS Attack Enables Unauthorized Data Access in Oracle MySQL Router
Weaknesses CWE-284

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Vulnerability in the MySQL Router product of Oracle MySQL (component: Router: General). The supported version that is affected is 26.7.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTPS to compromise MySQL Router. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all MySQL Router accessible data as well as unauthorized access to critical data or complete access to all MySQL Router accessible data. CVSS 3.1 Base Score 7.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N).
First Time appeared Oracle
Oracle mysql Router
CPEs cpe:2.3:a:oracle:mysql_router:26.7.0:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle mysql Router
References
Metrics cvssV3_1

{'score': 7.4, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N'}

Subscriptions

Oracle Mysql Router
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-10-22T15:16:32.156Z

Reserved: 2026-09-28T15:40:09.506Z

Link: CVE-2026-101783

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-20T22:18:33.937

Modified: 2026-10-22T16:17:16.757

Link: CVE-2026-101783

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-22T17:45:08Z

Weaknesses