What is the CVSS score of CVE-2026-22001?

CVE-2026-22001 has a CVSS 3.1 base score of 2.7 (Low). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

MySQL Server CVE-2026-22001

EUVD-2026-24299 LOW

Information Exposure (CWE-200)

2026-04-21 oracle

GHSA-xcgr-x2r4-j9mj

Information Disclosure Oracle Mysql Server

2.7

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

2.7 LOW

AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N

vuln.today AI

2.7 LOW

PR:H reflects mandatory high-privilege credential requirement; C:L captures partial read-only data exposure; no integrity or availability impact applies.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 24, 2026 - 06:38 vuln.today

EUVD ID Assigned

Apr 21, 2026 - 21:01 euvd

EUVD-2026-24299

CVE Published

Apr 21, 2026 - 20:35 nvd

LOW 2.7

DescriptionCVE.org

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Information Schema). Supported versions that are affected are 8.0.0-8.0.45, 8.4.0-8.4.8 and 9.0.0-9.6.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized read access to a subset of MySQL Server accessible data. CVSS 3.1 Base Score 2.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N).

AnalysisAI

Information disclosure in Oracle MySQL Server's Information Schema component allows high-privileged remote attackers to read an unauthorized subset of MySQL Server data across three major version lines. Affected are versions 8.0.0-8.0.45, 8.4.0-8.4.8, and 9.0.0-9.6.0. No public exploit code exists, EPSS exploitation probability sits at 0.03% (7th percentile), and CISA has not added this to KEV - all signals converge on this being a low-priority, low-severity finding appropriate for routine patch cycle treatment.

Technical ContextAI

MySQL Server's Information Schema is a read-only metadata repository exposing database structure, table definitions, column metadata, user grants, and server configuration to authenticated sessions. CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) indicates the root cause is an access-control deficiency in how the Information Schema filters or presents data to high-privileged callers, allowing reads beyond intended scope. The flaw exists across the Oracle MySQL Server product family confirmed via CPE cpe:2.3:a:oracle_corporation:mysql_server, spanning the 8.0.x LTS-era branch, the newer 8.4.x branch, and the entire 9.x line through 9.6.0. The vulnerability is accessible over the network via multiple MySQL-supported protocols (classic MySQL protocol and X Protocol), consistent with the AV:N vector.

RemediationAI

Apply Oracle's patches from the April 2026 Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpuapr2026.html. Specific fixed version numbers above the affected ceilings (8.0.45, 8.4.8, 9.6.0) are not independently confirmed in available references - consult the Oracle CPU directly to identify the minimum patched release for your branch. As a compensating control prior to patching, audit and reduce the number of accounts holding high MySQL privileges (DBA role, SUPER privilege, or equivalent), since the vulnerability is only reachable by PR:H accounts; removing unnecessary high-privilege grants directly limits exploitability without service disruption. Additionally, review INFORMATION_SCHEMA query patterns in application logs to establish a baseline and detect anomalous enumeration attempts. These controls carry no functional side effects for properly scoped deployments.