Description
Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/ODBC). The supported version that is affected is 26.7.0. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where MySQL Connectors executes to compromise MySQL Connectors. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Connectors and unauthorized read access to a subset of MySQL Connectors accessible data. CVSS 3.1 Base Score 6.8 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H).
Published: 2026-08-18
Score: 6.8 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A local attacker who can log on to the infrastructure where Oracle MySQL Connector/ODBC executes can trigger a denial-of-service condition by causing the driver to hang or crash. Additionally, the vulnerability allows the attacker to read a subset of data that the connector has access to, thereby exposing confidential information. The weakness is an improper access control flaw identified as CWE-284, and it also includes a heap-based buffer overread identified as CWE-125.

Affected Systems

The vulnerability affects Oracle Corporation’s MySQL Connectors product, specifically Connector/ODBC version 26.7.0.

Risk and Exploitability

The CVSS v3.1 base score is 6.8 with local access required and no user interaction. The EPSS score is less than 1%, and the flaw is not listed in CISA’s KEV catalog. Exploitation requires only local system access, so a compromised workstation or a service account with sufficient privileges could leverage the flaw. No network‑based attack vector is listed, so risk is confined to systems that host the connector and allow local execution.

Generated by OpenCVE AI on August 28, 2026 at 20:12 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the official patch or upgrade to the latest Connector/ODBC version that contains the fix.
  • If the connector is not required, uninstall or disable it on systems.
  • Enforce strict local access controls on the host running Connector/ODBC, ensuring only authorized users or system accounts can execute the driver.

Generated by OpenCVE AI on August 28, 2026 at 20:12 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 27 Aug 2026 18:00:00 +0000

Type Values Removed Values Added
Title mysql-connector-odbc: MySQL Connector/ODBC: Denial of Service via unauthenticated local access
Weaknesses CWE-125
References
Metrics threat_severity

None

 threat_severity

Moderate

Thu, 20 Aug 2026 18:30:00 +0000

Type Values Removed Values Added
Title Local Denial of Service and Data Exposure via Oracle MySQL Connector/ODBC 26.7.0

Thu, 20 Aug 2026 06:45:00 +0000

Type Values Removed Values Added
Title Local Denial of Service and Data Exposure via Oracle MySQL Connector/ODBC 26.7.0

Wed, 19 Aug 2026 21:15:00 +0000

Type Values Removed Values Added
Title MySQL Connector/ODBC 26.7.0 Local Denial of Service and Sensitive Data Exposure
Weaknesses CWE-200
CWE-285

Wed, 19 Aug 2026 16:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-284

Wed, 19 Aug 2026 14:30:00 +0000

Type Values Removed Values Added
First Time appeared Oracle mysql Connector/odbc
Oracle mysql Connectors
Vendors & Products Oracle mysql Connector/odbc
Oracle mysql Connectors

Wed, 19 Aug 2026 09:00:00 +0000

Type Values Removed Values Added
Title MySQL Connector/ODBC 26.7.0 Local Denial of Service and Sensitive Data Exposure
Weaknesses CWE-200
CWE-285

Tue, 18 Aug 2026 21:15:00 +0000

Type Values Removed Values Added
Description Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/ODBC). The supported version that is affected is 26.7.0. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where MySQL Connectors executes to compromise MySQL Connectors. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Connectors and unauthorized read access to a subset of MySQL Connectors accessible data. CVSS 3.1 Base Score 6.8 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H).
First Time appeared Oracle
Oracle mysql Connector\/odbc
CPEs cpe:2.3:a:oracle:mysql_connector\/odbc:26.7.0:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle mysql Connector\/odbc
References
Metrics cvssV3_1

{'score': 6.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H'}

Subscriptions

Oracle Mysql Connector/odbc Mysql Connector\/odbc Mysql Connectors
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-08-19T16:02:22.938Z

Reserved: 2026-08-04T22:06:34.616Z

Link: CVE-2026-71084

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Analyzed

Published: 2026-08-18T21:18:08.637

Modified: 2026-09-02T18:55:14.130

Link: CVE-2026-71084

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-08-18T21:03:26Z

Links: CVE-2026-71084 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-08-28T20:15:06Z

Weaknesses