Description
Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Client: mysqldump). Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and 26.7.0-26.7.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H).
Published: 2026-10-20
Score: 7.5 High
EPSS: < 1% Very Low
KEV: No
Impact: Remote Takeover
Action: Immediate Patch
AI Analysis

Impact

The vulnerability resides in the MySQL Server and MySQL Cluster components of Oracle MySQL, specifically in the mysqldump client. This flaw enables an unauthenticated attacker with network access to compromise the database instance, ultimately leading to full takeover of MySQL Server or MySQL Cluster. The weakness can result in substantial impacts on confidentiality, integrity, and availability, as indicated by the CVSS 3.1 score of 7.5, and is classified under CWE-20 and CWE-284. Successful attacks require an additional human interaction from a person other than the attacker, which reduces but does not eliminate attack feasibility.

Affected Systems

The vulnerability affects Oracle MySQL Server versions 8.4.0 through 8.4.12, 9.7.0 through 9.7.3, and 26.7.0 through 26.7.1. It also impacts Oracle MySQL Cluster versions 8.0.0 through 8.0.49, 8.4.0 through 8.4.12, 9.7.0 through 9.7.3, and 26.7.0 through 26.7.1. These products expose the mysqldump client to external networks.

Risk and Exploitability

The CVSS base score of 7.5 indicates a high severity risk. The attack vector is network, requiring high technical skill but no local privileges. The exploit is theoretically possible over multiple protocols and could lead to full takeover, though it requires a third‑party action and therefore has reduced immediate feasibility. EPSS is available at <1%, and the vulnerability is not listed in the CISA KEV catalog, suggesting that mass exploitation is not yet documented. Nonetheless, the potential for complete takeover warrants prompt mitigation.

Generated by OpenCVE AI on October 23, 2026 at 03:54 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the latest Oracle security update or upgrade MySQL Server and MySQL Cluster to release versions not covered by the affected ranges (≥ 8.4.13, ≥ 9.7.4, ≥ 26.7.2).
  • Immediately restrict network access to the mysqldump client and all MySQL administrative interfaces by configuring firewall rules or IP whitelisting until the patch is applied.
  • Enforce strict authentication, disable insecure default accounts, and enable encrypted (TLS) connections for all MySQL traffic to prevent unauthenticated or intercepted access.

Generated by OpenCVE AI on October 23, 2026 at 03:54 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 23 Oct 2026 16:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Fri, 23 Oct 2026 00:45:00 +0000

Type Values Removed Values Added
Title mysql: mysql: system takeover via mysqldump component
Weaknesses CWE-20
References
Metrics threat_severity

None

 threat_severity

Important

Thu, 22 Oct 2026 18:15:00 +0000

Type Values Removed Values Added
Title Unauthenticated Network Access Enables Takeover via mysqldump in Oracle MySQL
Weaknesses CWE-862

Thu, 22 Oct 2026 16:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-284

Wed, 21 Oct 2026 03:45:00 +0000

Type Values Removed Values Added
Title Unauthenticated Network Access Enables Takeover via mysqldump in Oracle MySQL
Weaknesses CWE-862

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Client: mysqldump). Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and 26.7.0-26.7.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H).
First Time appeared Oracle
Oracle mysql Cluster
Oracle mysql Server
CPEs cpe:2.3:a:oracle:mysql_cluster:*:*:*:*:*:*:*:*
cpe:2.3:a:oracle:mysql_server:*:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle mysql Cluster
Oracle mysql Server
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H'}

Subscriptions

Oracle Mysql Cluster Mysql Server
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-10-22T15:15:35.119Z

Reserved: 2026-09-28T15:40:09.507Z

Link: CVE-2026-101797

cve-icon Vulnrichment

Updated: 2026-10-22T15:12:35.510Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-20T22:18:35.503

Modified: 2026-10-22T16:17:18.007

Link: CVE-2026-101797

cve-icon Redhat

Severity : Important

Publid Date: 2026-10-20T21:22:59Z

Links: CVE-2026-101797 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-10-23T04:00:12Z

Weaknesses
  • CWE-20

    Improper Input Validation

  • CWE-284

    Improper Access Control