Description
Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are MySQL Server: 26.7.0-26.7.1; MySQL Cluster: 26.7.0-26.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster. Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).
Published: 2026-10-20
Score: 7.2 High
EPSS: < 1% Very Low
KEV: No
Impact: Remote Code Execution
Action: Immediate Patch
AI Analysis

Impact

The flaw resides in the optimizer component of MySQL Server and MySQL Cluster. An attacker with high privileges who can reach the database over the network can exploit the bug through multiple protocols, achieving full compromise of the database system. The impact spans confidentiality, integrity, and availability, allowing the attacker to take full control of the MySQL instance.

Affected Systems

The affected products are Oracle MySQL Server and Oracle MySQL Cluster versions 26.7.0 to 26.7.1. The vulnerability applies across the specified version range for both the standalone server and the clustered deployment.

Risk and Exploitability

The base CVSS score of 7.2 indicates a medium to high severity, and the vulnerability is considered easily exploitable. The EPSS score of < 1% indicates a very low yet non‑zero probability of exploitation, and the issue is not listed in the CISA KEV catalog. The likely attack vector is a remote network-based exploit, requiring an attacker with high privileges on the attacking host to achieve a takeover. Given its potential to fully compromise the database, the risk is substantial and warrants prompt remediation.

Generated by OpenCVE AI on October 23, 2026 at 03:55 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the latest Oracle MySQL patch that addresses the optimizer vulnerability.
  • Restrict MySQL service traffic to trusted hosts and remove unnecessary network protocols from the server configuration.
  • Continuously monitor database logs and network activity for signs of exploitation attempts.

Generated by OpenCVE AI on October 23, 2026 at 03:55 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 10 Nov 2026 21:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Fri, 23 Oct 2026 00:45:00 +0000

Type Values Removed Values Added
Title Remote Code Execution via Optimizer Exploit in MySQL Server/Cluster mysql: mysql: Server takeover by a privileged network attacker
Weaknesses CWE-267
References
Metrics threat_severity

None

 threat_severity

Important

Wed, 21 Oct 2026 03:00:00 +0000

Type Values Removed Values Added
Title Remote Code Execution via Optimizer Exploit in MySQL Server/Cluster
Weaknesses CWE-284

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are MySQL Server: 26.7.0-26.7.1; MySQL Cluster: 26.7.0-26.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster. Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).
First Time appeared Oracle
Oracle mysql Cluster
Oracle mysql Server
CPEs cpe:2.3:a:oracle:mysql_cluster:*:*:*:*:*:*:*:*
cpe:2.3:a:oracle:mysql_server:*:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle mysql Cluster
Oracle mysql Server
References
Metrics cvssV3_1

{'score': 7.2, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Oracle Mysql Cluster Mysql Server
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-10-22T15:16:25.206Z

Reserved: 2026-09-28T15:40:09.506Z

Link: CVE-2026-101786

cve-icon Vulnrichment

Updated: 2026-10-22T15:12:29.379Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-20T22:18:34.290

Modified: 2026-10-22T16:17:16.893

Link: CVE-2026-101786

cve-icon Redhat

Severity : Important

Publid Date: 2026-10-20T21:22:55Z

Links: CVE-2026-101786 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-10-23T04:00:12Z

Weaknesses
  • CWE-267

    Privilege Defined With Unsafe Actions

  • CWE-284

    Improper Access Control