What is the CVSS score of CVE-2026-35234?

CVE-2026-35234 has a CVSS 3.1 base score of 4.9 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.0%.

MySQL Server CVE-2026-35234

EUVD-2026-24438 MEDIUM

Improper Access Control (CWE-284)

2026-04-21 oracle

GHSA-p82p-w5j8-vgqq

Authentication Bypass Oracle Mysql Server

4.9

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.9 MEDIUM

AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

4.9 MEDIUM

Network vector (AV:N) confirmed via multi-protocol access; PR:H required per description (high-privileged attacker); only availability impacted (DoS), no confidentiality or integrity loss.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Red Hat

4.9 MEDIUM

qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 24, 2026 - 06:06 vuln.today

EUVD ID Assigned

Apr 21, 2026 - 21:01 euvd

EUVD-2026-24438

CVE Published

Apr 21, 2026 - 20:35 nvd

MEDIUM 4.9

DescriptionCVE.org

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Partition). Supported versions that are affected are 9.0.0-9.6.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).

AnalysisAI

Denial-of-service in Oracle MySQL Server's Partition component (versions 9.0.0-9.6.0) allows a high-privileged, network-connected attacker to cause a complete server hang or repeatable crash, resulting in full availability loss. Exploitation is constrained to authenticated users holding high database privileges (CVSS PR:H), sharply limiting the realistic attack surface. No public exploit code exists, EPSS is 0.04% (11th percentile), and SSVC confirms no known exploitation - placing this firmly in the low real-world priority tier despite its network-accessible vector.

Technical ContextAI

MySQL Server's Partition subsystem handles table partitioning features, which allow large tables to be segmented across physical storage units for performance and manageability. CWE-284 (Improper Access Control) identifies the root cause class as a failure to properly enforce access boundaries within partition-related processing, allowing a privileged user to trigger conditions that destabilize or crash the database server process. Affected products are confirmed via CPE cpe:2.3:a:oracle_corporation:mysql_server:*:*:*:*:*:*:*:* spanning versions 9.0.0 through 9.6.0, as corroborated by the EUVD entry EUVD-2026-24438. The vulnerability supports multiple protocols, consistent with MySQL's ability to accept connections over TCP/IP, named pipes, and shared memory, broadening the network exposure surface for any host-level network reach.

RemediationAI

Apply Oracle's Critical Patch Update for April 2026, detailed at https://www.oracle.com/security-alerts/cpuapr2026.html, which addresses this and other vulnerabilities in the same release cycle. No specific patched version number is independently confirmed in the available data - consult the CPU advisory directly for the exact target release version before upgrading. As a compensating control while patching is scheduled, restrict MySQL network access to trusted administrative host IPs using firewall rules or MySQL's bind-address directive, reducing the pool of hosts that can reach the server with high-privilege credentials. Additionally, audit and minimize the number of accounts granted SUPER or DBA-equivalent privileges; limiting these to named human accounts with MFA reduces the risk of misuse or credential compromise enabling this DoS. Note that restricting the use of table partitioning DDL in production (if operationally feasible) may reduce direct exposure, but this carries schema migration overhead and potential query performance impacts on large datasets.