Description
Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/ODBC). The supported version that is affected is 26.7.1. Difficult to exploit vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Connectors. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all MySQL Connectors accessible data as well as unauthorized access to critical data or complete access to all MySQL Connectors accessible data. CVSS 3.1 Base Score 6.8 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N).
Published: 2026-10-20
Score: 6.8 Medium
EPSS: n/a
KEV: No
Impact: Unauthorized data modification and potential full data access
Action: Immediate Patch
AI Analysis

Impact

A vulnerability in the Oracle MySQL Connector/ODBC component permits an attacker with low privileges and network access to create, delete, or modify critical data. Successful exploitation can result in unauthorized access to all data exposed through the connector, leading to significant confidentiality and integrity breaches as reflected by the CVSS 3.1 base score of 6.8. The weakness is an improper authorization flaw that allows privileged actions without proper checks.

Affected Systems

The affected product is Oracle MySQL Connector/ODBC, version 26.7.1. Only this specific release is identified as vulnerable, and the vulnerability is exploitable over multiple protocols from a remote network position.

Risk and Exploitability

The CVSS score of 6.8 indicates a moderate severity with confidentiality and integrity impacts. Since the EPSS score is not available and the vulnerability is not listed in CISA KEV, the likelihood of exploitation in the wild is uncertain but non-negligible. The attack is feasible for a low-privileged remote attacker who can reach the connector over supported protocols; exploitation would grant unauthorized data access and modification capabilities.

Generated by OpenCVE AI on October 21, 2026 at 02:12 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade to the latest Oracle MySQL Connector/ODBC release that contains the fix, as identified in the Oracle CPU October 2026 advisory
  • If a patch is not yet available, isolate the connector from untrusted networks and restrict network traffic to trusted hosts only
  • Disable any unused protocols or ODBC drivers that are not required for business operations
  • Enforce the principle of least privilege for the service account running the connector to limit the potential damage of an exploit

Generated by OpenCVE AI on October 21, 2026 at 02:12 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 21 Oct 2026 02:30:00 +0000

Type Values Removed Values Added
Title Unauthorized Data Modification via MySQL Connector/ODBC Vulnerability
Weaknesses CWE-284

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/ODBC). The supported version that is affected is 26.7.1. Difficult to exploit vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Connectors. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all MySQL Connectors accessible data as well as unauthorized access to critical data or complete access to all MySQL Connectors accessible data. CVSS 3.1 Base Score 6.8 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N).
First Time appeared Oracle
Oracle mysql Connector\/odbc
CPEs cpe:2.3:a:oracle:mysql_connector\/odbc:26.7.1:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle mysql Connector\/odbc
References
Metrics cvssV3_1

{'score': 6.8, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N'}

Subscriptions

Oracle Mysql Connector\/odbc
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-10-20T21:23:03.826Z

Reserved: 2026-09-28T15:40:09.508Z

Link: CVE-2026-101806

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-20T22:18:36.533

Modified: 2026-10-20T22:18:36.533

Link: CVE-2026-101806

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-21T02:15:07Z

Weaknesses