EUVD-2026-106033
GHSA-cr2v-p7vq-mvhw
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to connect to attacker-controlled endpoint
-
ExploitVictim initiates MySQL connection via Connector/Net
-
ExecutionTrigger flaw during connector protocol handling
-
ImpactDisclose subset of accessible data to attacker
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires that a victim using MySQL Connector/Net 26.7.0 be induced to perform a connection action (UI:R) - most plausibly initiating a connection to an attacker-controlled or impersonated MySQL server over one of the supported protocols. The key LIMITING factors are: (1) mandatory human interaction from a person other than the attacker, so purely automated/wormable exploitation is not possible; (2) impact is confined to unauthorized read of a subset of connector-accessible data, with no integrity or availability effect; and (3) only version 26.7.0 of Connector/Net is listed as affected. No authentication is required (PR:N confirmed from the vector). |
| Impact | This is a moderate-severity (CVSS 3.1 base 4.3) confidentiality-only issue in Oracle MySQL Connector/Net 26.7.0, and the combined signals point to a LOW real-world priority rather than an urgent threat. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N) shows network reach and no privileges required, but the mandatory user interaction (UI:R) and limited, partial confidentiality impact (C:L, with I:N/A:N) cap the damage significantly - there is no integrity or availability impact and only a subset of accessible data can be read. No EPSS score, CISA KEV listing, SSVC decision, or public POC was provided in the input, so there is no evidence of active or imminent exploitation; absence of these is consistent with a low-probability, hard-to-weaponize client-side flaw. IMPORTANT DATA CONFLICT: the input Tags label this 'Authentication Bypass,' but the Oracle description and CVSS vector describe an unauthorized-read (confidentiality) issue with no integrity impact and no authentication-control compromise - the tag appears mislabeled and should not drive triage. Net assessment: patch in the normal Oracle CPU cycle, not an emergency. |
| Exploit ScenarioDerived | Because Connector/Net is a client-side database library, a realistic scenario is an attacker who controls or impersonates a MySQL server (e.g., via a malicious endpoint or man-in-the-middle) and induces a victim user/application to connect to it, causing the connector to disclose a subset of accessible data. The CVSS low attack complexity (AC:L) makes the technical step easy, but success hinges on the required human interaction (UI:R) to initiate the connection. No public exploit code was identified in the provided data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Unauthorized read access to a subset of connector-accessible data in Oracle MySQL Connector/Net 26.7.0 can be triggered by an unauthenticated network attacker who convinces a victim to perform a connection action. The CVSS 3.1 base score is 4.3 with confidentiality-only impact (UI:R), and no public exploit identified at time of analysis, so real-world priority is low. Only version 26.7.0 is listed as affected in the supplied EUVD data.
RemediationAI
Apply the Connector/Net update referenced in Oracle's October 2026 Critical Patch Update advisory (https://www.oracle.com/security-alerts/cpuoct2026.html); the input does not provide an exact fixed version, so confirm the patched release in the advisory before deployment. Because exploitation requires the victim to initiate a connection (UI:R), reduce exposure by restricting outbound MySQL connections from .NET applications to known, trusted server endpoints, and enforce TLS server-certificate validation where Connector/Net supports it to make server impersonation harder. Trade-offs: egress filtering can break legitimate connections to external or cloud MySQL instances and requires an allowlist; strict certificate validation may fail against self-signed or misconfigured servers and needs a controlled rollout. User awareness should target avoiding ad-hoc connections to untrusted hosts. No public exploit identified at time of analysis, so emergency out-of-band patching is not indicated by the available data.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
MySQL Connector/Net is Oracle's ADO.NET driver that lets .NET applications connect to MySQL servers. The supplied CWE is not populated, and the tagged 'Authentication Bypass' label is not consistent with the assessed vector, which is a confidentiality-only information exposure (C:L, no I/A). The attack path requires network reachability (AV:N) and no privileges (PR:N), but it also requires user interaction (UI:R) - the victim must be induced to initiate a connection, most plausibly to an attacker-controlled or impersonated MySQL server over one of the supported protocols. That interaction constraint prevents automated, wormable exploitation and confines impact to reading a subset of data the connector can access; there is no integrity or availability effect. The EUVD data lists only Connector/Net 26.7.0 as affected, and no CPE strings were provided to broaden the scope.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Client-side connector reachable over the network (AV:N) with low complexity but needing a user-initiated connection (UI:R); unauthenticated (PR:N) with only partial confidentiality loss (C:L), no I/A impact.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/Net). The supported version that is affected is 26.7.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Connectors. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized read access to a subset of MySQL Connectors accessible data. CVSS 3.1 Base Score 4.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N).
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
Exploit-DB