What is the CVSS score of CVE-2026-35235?

CVE-2026-35235 has a CVSS 3.1 base score of 4.9 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.0%.

MySQL Server CVE-2026-35235

EUVD-2026-24439 MEDIUM

Improper Access Control (CWE-284)

2026-04-21 oracle

GHSA-c26m-jpm8-jfvw

Authentication Bypass Oracle Mysql Server Oracle Corporation

4.9

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.9 MEDIUM

AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

4.9 MEDIUM

Network-reachable via MySQL protocols, no interaction needed, but mandatory high-privilege authentication limits scope; availability-only impact from GIS-triggered server crash.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Red Hat

4.9 MEDIUM

qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 24, 2026 - 06:05 vuln.today

EUVD ID Assigned

Apr 21, 2026 - 21:01 euvd

EUVD-2026-24439

CVE Published

Apr 21, 2026 - 20:35 nvd

MEDIUM 4.9

DescriptionCVE.org

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: GIS). Supported versions that are affected are 9.0.0-9.6.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).

AnalysisAI

Denial-of-service in Oracle MySQL Server's GIS (Geographic Information System) component allows a high-privileged, network-authenticated attacker to cause the database server to hang or repeatedly crash. Versions 9.0.0 through 9.6.0 are confirmed affected. No public exploit has been identified and EPSS probability stands at 0.04% (11th percentile), consistent with SSVC's exploitation rating of 'none' - real-world risk is confined primarily to insider threat or compromised DBA account scenarios.

Technical ContextAI

MySQL Server's GIS component implements spatial data types and geographic query functions (e.g., ST_* family), conforming to OGC standards. CWE-284 (Improper Access Control) is cited as the root cause class; in the context of a DOS-only, high-privilege vulnerability, this likely reflects insufficient input validation or boundary enforcement within the spatial query processing pipeline rather than a classical authentication bypass. The flaw is reachable over multiple MySQL-supported network protocols (classic MySQL protocol and X Protocol). Affected CPE is cpe:2.3:a:oracle_corporation:mysql_server:*:*:*:*:*:*:*:* spanning versions 9.0.0 to 9.6.0 inclusive. The 'Authentication Bypass' tag present in threat intelligence metadata is inconsistent with the CVSS PR:H metric and the description's explicit 'high privileged attacker' language - this tag appears misapplied and should not inform risk decisions.

RemediationAI

Apply Oracle's April 2026 Critical Patch Update (CPU), documented at https://www.oracle.com/security-alerts/cpuapr2026.html. The specific patched release version is not independently confirmed from the available references - consult the CPU documentation directly to identify the exact target upgrade version for MySQL 9.x. As a compensating control, enforce strict least-privilege account management for MySQL: limit high-privileged (DBA/SYSTEM) accounts to operationally required users and audit active accounts regularly, since exploitation is gated on PR:H access. Network-level firewall rules restricting MySQL port (3306/33060) access to authorized management hosts reduce the network exposure surface without eliminating insider risk. Consider enabling MySQL audit logging to detect anomalous or repetitive spatial query patterns that may indicate exploitation probing. These controls reduce attack surface but do not remediate the underlying flaw.