Denial of service in the Eclipse ThreadX Module Manager (CWE-400) lets a loaded user-mode module permanently drain the shared module object pool by cycling threads. Each thread a module creates consumes two allocations - a TX_THREAD control block plus a separately allocated TXM_MODULE_KERNEL_STACK_SIZE kernel stack - but the thread-delete dispatcher releases only the control block, so every valid create/terminate/delete cycle silently removes one fixed-size block from a finite pool shared by the Module Manager and all other loaded modules. A module that loops this lifecycle long enough exhausts the pool, after which no memory-protected module anywhere in the system can create kernel objects or new user-mode threads. Exploitation requires local execution of a loadable user-mode module (PR:L per the assessed CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H vector) and is purely an availability impact; no public exploit code or confirmed active exploitation was identified at time of analysis.
Truncated JPEG marker segments and a zero chroma sampling factor in Eclipse ThreadX GUIX's software JPEG decoder can trigger an out-of-bounds read and a non-terminating block-decode loop, letting a local, unauthenticated attacker who can get a crafted JPEG opened or rendered crash or hang the device and potentially disclose a small amount of adjacent memory. Both triggers reproduce in the default configuration with GX_SOFTWARE_DECODER_SUPPORT enabled; the CVSS 3.1 score is 6.1 (AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H), so the dominant outcome is availability loss rather than large-scale data theft. No public exploit code or CISA KEV entry was identified at time of analysis, and no EPSS score was provided.
An out-of-bounds read in the Eclipse ThreadX GUIX JPEG software decoder lets a crafted JPEG file expose memory beyond an undersized image buffer. The flaw affects GUIX builds with GX_SOFTWARE_DECODER_SUPPORT enabled, which is the shipped default, and is triggered by a JPEG whose marker ordering is illegal - specifically a second SOF0 frame header placed after SOS - which re-parses the frame header after the output buffer has already been allocated and its geometry latched. The decoder then returns GX_SUCCESS and publishes a GX_PIXELMAP whose reported dimensions and data_size exceed the actual allocation, so any consumer trusting the structure, including GUIX's own display drivers via the ordinary draw path, reads past the buffer; interaction is required and the attack is local (the malicious file must reach the decoder), and no public exploit code has been identified at time of analysis.
Out-of-bounds reads in Eclipse ThreadX GUIX can expose adjacent memory or terminate the application when gx_binres_theme_load() or gx_binres_font_load() processes a crafted theme or font resource that declares more data than it contains or embeds an out-of-range offset. The loaders accept a bare resource pointer with no length, so file-controlled offsets can drive reads past the buffer end; a well-formed, narrow glyph range is sufficient, and no underflow or integer-wrap is required. Exploitation is local and requires the application to load an untrusted GUIX resource, and no public exploit or CISA KEV activity is identified at time of analysis.
Out-of-bounds write in the Eclipse ThreadX GUIX binary resource theme loader lets an attacker who supplies a crafted GUIX theme file corrupt the GUIX memory arena and potentially hijack execution or crash the device. The flaw is only reachable in products that call the public API gx_binres_theme_load() on externally supplied or user-replaceable theme files, with GX_BINARY_RESOURCE_SUPPORT compiled in (the shipped default). CVSS 4.0 rates this 6.8 (Medium) with a local attack vector and required user interaction; no public exploit code and no CISA KEV entry were identified at time of analysis.
Eclipse OpenJ9 through 0.63 can expose local files to a remote receiver when an analyst opens a crafted diagnostic dump bundle with jdmpview or equivalent legacy DTFJ code. The bundle's XML metadata can define an external entity that references an arbitrary local file, causing the tool to read that file and transmit its contents to an attacker-controlled host. This is a local, user-interaction-dependent issue in the legacy DTFJ XML path; no public exploit was identified at time of analysis, and the risk is moderate and context-dependent rather than a mass-exploitation priority.
Local service takeover in Oracle Mobile Field Service (Oracle E-Business Suite) versions 12.2.3 through 12.2.15 allows an attacker who already holds high-privileged logon to the host infrastructure to compromise the service, with high confidentiality, integrity, and availability impact. Exploitation requires local access and pre-existing high privileges, which confines realistic risk to insiders or attackers who have already compromised the host; no public exploit identified at time of analysis. The October 2026 Oracle Critical Patch Update remediates the flaw.
A local privilege-escalation-style flaw in Oracle Mobile Field Service (part of Oracle E-Business Suite, Internal Operations component) lets an attacker who already holds a high-privileged account on the host where the service runs take full control of the affected component, with high impact to confidentiality, integrity and availability. Only E-Business Suite deployments running versions 12.2.3 through 12.2.15 are affected, and because the vector is local (AV:L) with PR:H, the practical exposure is limited to trusted insiders or attackers who have already compromised a privileged host account; no public exploit code or active exploitation has been identified at time of analysis. Oracle addresses it in its October 2026 Critical Patch Update, so patch availability exists via the vendor advisory.
Local privilege abuse in the Siebel CRM Deployment component (Server Infrastructure) of Oracle Siebel CRM lets an attacker who already holds a high-privileged account on the deployment host take full control of that component, with high confidentiality, integrity, and availability impact confined to Siebel CRM Deployment itself (scope unchanged). Supported releases 17.0 through 26.9 are affected; the CVSS 3.1 base score is 6.7 (AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H). The attack path is not remotely reachable and requires existing privileged local logon, which limits the practical threat to insiders or intruders who have already compromised a privileged account on the host; no public exploit identified at time of analysis, and the issue is not listed as confirmed actively exploited (CISA KEV).
Local, highly privileged users on hosts running Oracle JD Edwards EnterpriseOne Tools 9.2.0.0 through 9.2.26.5 can exploit the Package Build SEC component to compromise the confidentiality, integrity, and availability of the installation, with a CVSS 3.1 base score of 6.7. Exploitation requires logon access to the underlying infrastructure and pre-existing high privileges, so realistic exposure is limited to malicious insiders or attackers who have already compromised a privileged account rather than external unauthenticated users. No public exploit code was identified and the issue is not confirmed as actively exploited at time of analysis, making this a moderate-priority hardening item rather than an emergency patch.
Local privilege escalation in Oracle Communications Billing and Revenue Management can let an attacker who already holds high-privileged host access compromise the Platform component, affecting versions 15.0.0.0.0 through 15.2.0.0.0. The CVSS 3.1 score is 6.7 with AV:L/PR:H, so the main barrier is the requirement for a high-privileged local logon rather than network reachability; no public exploit was identified at time of analysis.
Local privilege-abuse in Oracle Communications Billing and Revenue Management (BRM) 15.0.0.0.0, 15.0.1.0.0, 15.1.0.0.0 and 15.2.0.0.0 lets an attacker who already holds a high-privileged logon on the BRM host fully compromise the application, with high confidentiality, integrity and availability impact and unchanged scope (CVSS 3.1 base 6.7). The attack is not network-reachable and requires no user interaction once the privileged host foothold exists, so the realistic threat population is insiders, compromised administrator accounts, or an adversary who has already escalated on the underlying infrastructure. No public exploit code or confirmed active exploitation was identified at time of analysis, and no EPSS score was supplied; severity is driven by the value of the BRM platform rather than by ease of remote access.
High-privileged local attackers can take over Oracle MySQL Server and MySQL Cluster through the Server: Components Services component, affecting MySQL Server 8.4.0-8.4.12, 9.7.0-9.7.3, and 26.7.0-26.7.1 plus MySQL Cluster 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3, and 26.7.0-26.7.1. The CVSS 3.1 score is 6.7 (AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), so exploitation requires an existing high-privileged account with logon to the MySQL host rather than remote or unauthenticated access. No CISA KEV listing or public exploit code is reported in the supplied data; no public exploit identified at time of analysis.
Local privilege escalation in the Server Infrastructure component of Oracle Siebel CRM Deployment (supported versions 17.0 through 26.9) lets an attacker who already holds high-privileged logon access on the deployment host take over the Siebel CRM Deployment instance, with full confidentiality, integrity, and availability impact confined to that component. The attack is local (AV:L), requires high privileges (PR:H), and needs no user interaction. No public exploit code or confirmed active exploitation was identified at time of analysis, and the CVSS 3.1 base score of 6.7 reflects a moderate-priority issue whose real-world risk is strongly constrained by the mandatory prior privileged foothold on the server.
Oracle Siebel CRM Deployment (Server Infrastructure component), versions 17.0 through 26.9, can be fully compromised - confidentiality, integrity and availability - by an attacker who already holds a high-privileged logon on the host where the deployment component runs. The flaw is not remotely reachable: exploitation requires local access plus administrative credentials (CVSS 3.1 6.7, AV:L/PR:H/UI:N), but once those prerequisites are met, attack complexity is low and no user interaction is needed, making it a realistic post-compromise or insider escalation path rather than an external entry point. No public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis, and no EPSS data was supplied.
Siebel CRM Deployment (Server Infrastructure component) versions 17.0 through 26.9 can be taken over by an attacker who already holds a high-privileged account and has interactive logon access to the infrastructure host where the component executes. The issue is rated CVSS 3.1 base 6.7 with high confidentiality, integrity, and availability impact, but the local attack vector (AV:L) and high-privilege prerequisite (PR:H) sharply constrain the realistic attacker population to insiders or actors who already have a foothold. No public exploit identified at time of analysis; no CISA KEV entry is present in the provided data.
Local takeover of Oracle JD Edwards EnterpriseOne Tools (9.2.0.0 through 9.2.26.5, E1 Dev Platform Tech component on UNIX) is achievable by an attacker who already holds a low-privileged logon account on the host, but only if a separate user performs a triggering interaction and difficult-to-satisfy conditions are met (CVSS 3.1 base 6.7, AV:L/AC:H/PR:L/UI:R). Successful exploitation gives high confidentiality, integrity and availability impact within the Tools product, effectively handing the attacker control of the platform from an already-established local foothold. Oracle addressed the flaw in its October 2026 Critical Patch Update; no public exploit code and no confirmed active exploitation were identified at time of analysis, and the local-access, authentication and victim-interaction prerequisites substantially limit real-world exposure.
Complete takeover of Oracle Agile PLM MCAD Connector 3.6 can be achieved by a low-privileged attacker who already has local logon access, provided a separate user interacts with attacker-supplied content; high attack complexity and the mandatory second-party action sharply limit practical risk. No public exploit code, CISA KEV entry, or EPSS score was provided at time of analysis.
The SCIM provisioning API in Grafana Enterprise resolves user objects by ID without scoping them to the caller's organization, so a service account holding user-management permissions in one org can read, modify, disable, or delete users that belong to every other org on the same instance (CWE-639 IDOR). Only Enterprise deployments with the non-default SCIM feature turned on are exposed, and the attacker must already control a privileged service account token (CVSS PR:H), which keeps this a moderate-priority 6.7 authorization flaw rather than a pre-auth compromise path. Practical impact concentrates on multi-organization, multi-tenant instances where cross-org victims actually exist; no public exploit identified at time of analysis and no confirmed active exploitation (CISA KEV).
Oracle Payroll in Oracle E-Business Suite 12.2.3 through 12.2.15 presents a moderate-priority, full-impact takeover risk: an attacker who already holds high privileges in the application and can reach it over HTTP may compromise confidentiality, integrity, and availability, but Oracle rates exploitation as difficult due to high attack complexity. No public exploit code or confirmed active exploitation was identified at time of analysis.
High-privileged attackers with network access to PeopleSoft Enterprise PeopleTools 8.61 through 8.63 can exploit a high-complexity flaw in the Multichannel Framework component to take over the affected PeopleTools instance, with full confidentiality, integrity, and availability impact. The vulnerability requires an authenticated account with high privileges and specific exploit conditions, so it is not reachable by anonymous remote users. No public exploit code or active exploitation is identified at time of analysis.
Successful exploitation of Oracle Mobile Field Service within Oracle E-Business Suite 12.2.3 through 12.2.15 allows an attacker who already holds high privileges on the instance to take full control of the module, with high confidentiality, integrity and availability impact per Oracle's CVSS 3.1 score of 6.6. The component is reachable over HTTP but is explicitly rated difficult to exploit (AC:H), and the PR:H prerequisite sharply limits the pool of viable attackers to those who have already obtained elevated access. No public exploit code has been identified at time of analysis, and the issue is addressed in Oracle's October 2026 Critical Patch Update.
High-privileged, authenticated attackers with network access can achieve takeover of Oracle EDI Gateway in Oracle E-Business Suite 12.2.3 through 12.2.15 by exploiting a difficult-to-trigger flaw in the component's miscellaneous EDI issue handling. The CVSS 3.1 base score is 6.6 with High confidentiality, integrity, and availability impact, but the high privilege prerequisite (PR:H) and high attack complexity (AC:H) keep this a moderate-priority issue rather than an emergency. No public exploit code or confirmed active exploitation was identified at time of analysis.
High-privileged SQL access to the Monitoring and Diagnostics SEC component of Oracle JD Edwards EnterpriseOne Tools (versions 9.2.0.0 through 9.2.26.5) can yield unauthorized read of critical data and limited insert/update/delete capability, with a scope change that lets the impact propagate to additional connected products. Exploitation is explicitly rated difficult (AC:H) and is gated behind an attacker who already holds high privileges (PR:H) plus network reachability; no user interaction is required (UI:N). The CVSS 3.1 base score is 6.6, and no public exploit identified at time of analysis. Risk is therefore concentrated in environments where administrative or otherwise highly privileged JD Edwards accounts are shared, weakly controlled, or exposed to untrusted networks.
Siebel Cloud Manager, a component of Oracle Siebel CRM Cloud Applications versions 22.3 through 26.9, permits a high-privileged attacker with HTTP network access to create, delete, or modify critical data and to read a limited subset of application data, with the added risk that a successful exploit can significantly affect additional products beyond the vulnerable component (scope change). The flaw is explicitly difficult to exploit and requires the attacker to already hold elevated privileges on the Cloud Manager interface, so realistic risk is concentrated among insiders or attackers who have already compromised an administrative account. No public exploit code has been identified at time of analysis, and Oracle addressed the issue in its October 2026 Critical Patch Update.
JD Edwards EnterpriseOne Tools 9.2.0.0 through 9.2.26.5 contains a difficult-to-exploit security weakness in the Monitoring and Diagnostics SEC component that lets a high-privileged attacker with HTTP network access read critical data and make limited updates, with scope change potentially affecting additional products. The CVSS 3.1 score is 6.6 (AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:L/A:N), requiring an already privileged account and high attack complexity. No public exploit code or CISA KEV entry was identified at time of analysis; EPSS was not provided.
Physical-access attackers who can convince a legitimate operator to interact with a crafted element can achieve complete takeover of Oracle Fusion Middleware Control 12.2.1.4.0 and 14.1.2.0.0 (Framework component), with high confidentiality, integrity and availability impact under CVSS 3.1 scoring of 6.6. The moderate score is driven almost entirely by the attack vector (AV:P) and the required victim interaction (UI:R) rather than by any weakness in the impact, and no attacker authentication (PR:N) is needed once those two preconditions are met. No public exploit code has been identified and the issue is not listed in CISA KEV at time of analysis; Oracle ships the fix through its October 2026 Critical Patch Update cycle.
DOM-based cross-site scripting in the Stormshield Network Security web administration panel lets an attacker run arbitrary script inside a logged-in administrator's browser session when the admin follows a crafted link containing a payload in a specific request parameter. Successful exploitation exposes data available to the authenticated session, which the assessed vector rates as high confidentiality impact with no integrity or availability effect (S:C/C:H/I:N/A:N). Rated medium severity at CVSS 6.6, the flaw is constrained by mandatory user interaction, adjacent-network access, and the need to socially engineer a currently authenticated administrator; no public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis, so it warrants scheduled rather than emergency patching.
Local low-privileged users on hosts running Oracle Outside In Technology 8.5.8 can abuse the Clean Content SDK document-processing path to create, delete, or modify critical data, read a limited subset of accessible data, and cause a partial denial of service. The flaw carries a CVSS 3.1 base score of 6.6 with an integrity-heavy profile (I:H, C:L, A:L) and requires an existing local logon (AV:L, PR:L) without user interaction, making it a moderate local threat rather than a remotely reachable one. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV.
PeopleSoft Enterprise PeopleTools 8.61 through 8.63 can be repeatedly crashed and have some of its data read or altered by a low-privileged user who already has a logon on the host or application-tier infrastructure where PeopleTools runs. The flaw is in the Porting component and is local-only (CVSS AV:L, PR:L), so it is not remotely reachable without an existing foothold; no user interaction is required. Oracle rates it 6.6, and no public exploit code or CISA KEV activity was identified at the time of analysis.
High-privileged attackers with HTTP access to PeopleSoft Enterprise PeopleTools 8.61 through 8.63 can exploit the Meta Data component to read critical application data and cause a hang or repeatable crash, producing high confidentiality and availability impact. The issue is rated CVSS 3.1 6.5 and requires an already high-privileged PeopleSoft account (PR:H), so exploitation is realistic mainly for trusted insiders or attackers who already hold privileged credentials. No public exploit code or CISA KEV entry was identified at time of analysis.
Resource exhaustion in ApostropheCMS's import-export module before 3.7.1 allows an authenticated user with importer permission to submit archives whose decompressed bytes, entry count, or per-entry sizes are not bounded before document-type authorization, potentially consuming server resources and leaving staging or extracted artifacts behind after extraction or parsing failures. The flaw is network-reachable and low-complexity but requires a logged-in importer (PR:L), and the maintainers have not validated the full end-to-end denial-of-service impact, so the assessed availability effect is limited. No public exploit or CISA KEV entry is identified in the provided data; the issue is fixed in @apostrophecms/import-export 3.7.1.
Authenticated attackers with high database privileges can exploit the Server: XML component in MySQL Server 8.4.x, 9.7.x, and 26.7.x, as well as MySQL Cluster 8.0.x, 8.4.x, 9.7.x, and 26.7.x, over the network to modify or delete critical data and to hang or repeatedly crash the service. The flaw has low attack complexity and requires no user interaction, but the PR:H prerequisite limits practical risk to insiders, compromised privileged accounts, or post-authentication attack chains; confidentiality is not affected. No public exploit code or CISA KEV entry was identified at time of analysis.
Denial of service in Oracle MySQL Server and MySQL Cluster JSON processing allows a low-privileged authenticated attacker with network access to hang or repeatedly crash the database service (CVSS 3.1 score 6.5, availability-only). Affected releases include MySQL Server 8.4.0-8.4.12, 9.7.0-9.7.3, and 26.7.0-26.7.1, plus MySQL Cluster 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3, and 26.7.0-26.7.1. The CVSS vector confirms PR:L authentication is required, and no public exploit was identified at time of analysis; no CISA KEV status was supplied.
A low-privileged authenticated attacker with network access can repeatedly crash or hang the MySQL Server or MySQL Cluster service by abusing flaw handling in the Server: Pluggable Auth component, yielding complete denial of service against the database. Affected releases are MySQL Server 8.4.0-8.4.12, 9.7.0-9.7.3 and 26.7.0-26.7.1, plus MySQL Cluster 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and 26.7.0-26.7.1, as documented in the Oracle Critical Patch Update for October 2026. The CVSS 3.1 score is 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H); no public exploit code and no CISA KEV entry are associated with this CVE at time of analysis, and EPSS data was not provided.
Denial of service in Oracle MySQL Server and MySQL Cluster allows low-privileged authenticated users with network access to hang or repeatedly crash the service via the C API component. Affected builds are MySQL Server 8.4.0-8.4.12, 9.7.0-9.7.3, and 26.7.0-26.7.1, plus MySQL Cluster 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3, and 26.7.0-26.7.1. No public exploit identified at time of analysis, and impact is limited to availability with a CVSS 3.1 base score of 6.5.
Denial of service in Oracle MySQL Server (C API component) and MySQL Cluster allows an authenticated low-privileged attacker with network access to hang or repeatedly crash the database, causing complete availability loss. Affected branches include MySQL Server 8.4.0-8.4.12, 9.7.0-9.7.3, and 26.7.0-26.7.1 plus MySQL Cluster 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3, and 26.7.0-26.7.1; CVSS 3.1 is 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). No public exploit was identified at time of analysis, and exploitation requires valid low-privileged credentials and network reachability.
MySQL Cluster 9.7.3 can be driven into a hang or repeatable full crash through its NDB Operator component by an attacker who holds a valid low-privilege account and can reach the operator's HTTP endpoint over the network. The flaw is an availability-only issue: there is no data disclosure or modification, but a successful attack takes the cluster's management plane down and can be repeated to sustain the outage. Oracle addressed it in its October 2026 Critical Patch Update, and no public exploit code or confirmed active exploitation was identified at time of analysis; the realistic threat is a malicious or compromised authenticated tenant/operator user rather than an anonymous internet attacker.
Authenticated low-privileged HTTP requests to Oracle Siebel CRM Deployment's Server Infrastructure component can hang or repeatedly crash the service, producing a complete denial of service across all supported releases 17.0 through 26.9 (CVSS 3.1 base 6.5). The attack is network-reachable and low-complexity with no user interaction, but it requires valid low-privileged credentials (PR:L), so risk is bounded to authenticated users, compromised accounts, and malicious insiders rather than anonymous internet attackers. Impact is availability-only - no data disclosure or modification - and no public exploit code or confirmed active exploitation was identified at time of analysis.
Denial of service in Oracle WebCenter Content's Content Server component lets an authenticated low-privileged attacker with network HTTP access hang or repeatedly crash the application, affecting versions 12.2.1.4.0 and 14.1.2.0.0. The CVSS 3.1 score is 6.5 with availability-only impact (A:H; no confidentiality or integrity effect), and no public exploit code or CISA KEV entry was identified at time of analysis. This is a moderate availability risk rather than a top-tier emergency, but it is easily triggered once valid low-privileged credentials exist.
Denial of service in Oracle MySQL Server and MySQL Cluster allows a low-privileged authenticated remote attacker to hang or repeatedly crash the database by sending crafted SQL that reaches the Server: Parser component. MySQL Server 8.4.0-8.4.12, 9.7.0-9.7.3, and 26.7.0-26.7.1 plus MySQL Cluster 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3, and 26.7.0-26.7.1 are affected. The CVSS 3.1 score is 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H); no public exploit code or CISA KEV entry is identified in the provided data.
Denial of service in Oracle MySQL Server and MySQL Cluster allows a low-privileged authenticated account with network access to hang or repeatedly crash the database service through the Server: XML component. Affected builds are MySQL Server 8.4.0-8.4.12, 9.7.0-9.7.3 and 26.7.0-26.7.1, plus MySQL Cluster 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and 26.7.0-26.7.1. The issue is availability-only (CVSS 3.1 6.5, AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H); no public exploit code or CISA KEV entry was identified at time of analysis, so practical risk is moderate and driven by exposure of MySQL accounts and ports.
Denial of service in MySQL Server and MySQL Cluster (Server: Optimizer component) allows an authenticated low-privilege attacker with network access to cause a hang or frequently repeatable crash of the database service, resulting in complete loss of availability for the affected instance. Affected releases include MySQL Server 8.4.0-8.4.12, 9.7.0-9.7.3, and 26.7.0-26.7.1, plus MySQL Cluster 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3, and 26.7.0-26.7.1. No public exploit identified at time of analysis, and risk is concentrated on multi-tenant, shared, or externally reachable instances where untrusted or compromisable low-privilege accounts exist.
Repeated-crash denial of service in Oracle MySQL Server (X Plugin component) and MySQL Cluster allows a low-privileged, network-positioned user to hang or fully take down the database service. Affected builds are MySQL Server 8.4.0-8.4.12, 9.7.0-9.7.3 and 26.7.0-26.7.1, plus MySQL Cluster 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and 26.7.0-26.7.1. Oracle rates it CVSS 3.1 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), meaning the attacker must already hold a low-privileged account but needs no user interaction; there is no confidentiality or integrity impact and no code execution path, and no public exploit or CISA KEV listing was identified at time of analysis.
Denial of service in Oracle MySQL Server and MySQL Cluster allows an authenticated low-privilege attacker to hang or repeatedly crash the database service over the network. The flaw affects the Server: Components Services component in MySQL Server 8.4.0-8.4.12, 9.7.0-9.7.3, and 26.7.0-26.7.1, plus MySQL Cluster 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3, and 26.7.0-26.7.1; it is rated CVSS 6.5 with availability-only impact. No public exploit was identified at time of analysis, and the main prerequisite is a valid low-privilege database account reachable over MySQL-supported protocols.
Low-privileged database users with network access can repeatedly crash or hang MySQL Server and MySQL Cluster through the Security: Audit subsystem, producing a complete denial of service against the instance. The flaw carries a CVSS 3.1 score of 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) and affects MySQL Server 8.4.0-8.4.12, 9.7.0-9.7.3 and 26.7.0-26.7.1 plus MySQL Cluster 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and 26.7.0-26.7.1. Exploitation is not known to be active and no public exploit code has been identified at time of analysis, but the only real prerequisite is a valid low-privileged account - no user interaction or elevated rights - so exposure is greatest where shared or untrusted application accounts can reach the listener. This is a moderate-priority availability flaw, not a critical breach risk: confidentiality and integrity are unaffected.
Denial of service in Oracle MySQL Server and MySQL Cluster allows a low-privileged authenticated database user to hang or repeatedly crash the service via network-accessible InnoDB operations. Affected branches include MySQL Server 8.4.0-8.4.12, 9.7.0-9.7.3, and 26.7.0-26.7.1, plus MySQL Cluster 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3, and 26.7.0-26.7.1. The CVSS 3.1 score is 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H); no public exploit identified at time of analysis and no CISA KEV confirmation was present in the supplied intelligence.
Authenticated low-privileged users can crash or hang MySQL Server and MySQL Cluster 26.7.0 through 26.7.1 by sending crafted queries over the network that exercise the Server: GIS (spatial data) component, producing a complete denial of service. The flaw is rated CVSS 3.1 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), so only availability is affected and valid credentials are required. No public exploit code or confirmed active exploitation was identified at time of analysis, and Oracle's October 2026 Critical Patch Update advisory is the reference point for fixes.
Denial of service in Oracle MySQL Server and MySQL Cluster lets authenticated low-privileged network attackers hang or repeatedly crash the database by exercising JSON functionality. The flaw is in the Server: JSON component and affects MySQL Server 8.4.0-8.4.12, 9.7.0-9.7.3, and 26.7.0-26.7.1, plus MySQL Cluster 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3, and 26.7.0-26.7.1. Exploitation requires a valid low-privileged MySQL account and network access over a supported client protocol; impact is availability-only, and no public exploit was identified at time of analysis.
Low-privileged authenticated attackers with network access can hang or repeatedly crash the MySQL Server and MySQL Cluster Optimizer component (CVE-2026-101608), causing complete denial of service. Affected builds are MySQL Server 8.4.0-8.4.12, 9.7.0-9.7.3 and 26.7.0-26.7.1, plus MySQL Cluster 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and 26.7.0-26.7.1; the CVSS 6.5 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) reflects availability-only impact with no data disclosure or modification. A valid low-privilege account is the main barrier to exploitation, and no public exploit code or confirmed active exploitation was identified at time of analysis.