What is the CVSS score of CVE-2026-35236?

CVE-2026-35236 has a CVSS 3.1 base score of 4.9 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-35236?

Yes, a patch is available for CVE-2026-35236. Update the affected software to the latest version immediately.

MySQL Server CVE-2026-35236

EUVD-2026-24440 MEDIUM

Improper Access Control (CWE-284)

2026-04-21 oracle

GHSA-cv52-82gr-h293

Authentication Bypass Oracle Mysql Server Oracle Corporation

4.9

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.9 MEDIUM

AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

4.9 MEDIUM

Network vector confirmed; PR:H because exploitation requires existing high-privilege DB credentials; availability-only impact with no confidentiality or integrity effect.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

SUSE

MEDIUM

qualitative

Red Hat

4.9 MEDIUM

qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 24, 2026 - 06:04 vuln.today

EUVD ID Assigned

Apr 21, 2026 - 21:01 euvd

EUVD-2026-24440

CVE Published

Apr 21, 2026 - 20:35 nvd

MEDIUM 4.9

DescriptionCVE.org

Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.0-8.0.45, 8.4.0-8.4.8 and 9.0.0-9.6.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).

AnalysisAI

InnoDB component in MySQL Server versions 8.0.0-8.0.45, 8.4.0-8.4.8, and 9.0.0-9.6.0 exposes a denial-of-service condition reachable over the network by a highly privileged attacker, causing the database server to hang or crash repeatably. Disclosed as part of Oracle's April 2026 Critical Patch Update (CVSS 3.1: 4.9), the vulnerability has an EPSS of 0.04% (11th percentile), SSVC exploitation status of 'none', and no public exploit identified at time of analysis. Oracle has released a patch; risk is largely limited to scenarios involving compromised administrative credentials or malicious insiders.

Technical ContextAI

MySQL Server's InnoDB storage engine - the default transactional engine handling row-level locking, MVCC, and crash recovery - is the affected component. The root cause is classified as CWE-284 (Improper Access Control), suggesting the InnoDB layer fails to correctly enforce access control for certain privileged operations, allowing an authenticated high-privilege user to drive the engine into an unrecoverable or looping state. The vulnerability is reachable via multiple network protocols supported by MySQL, including the classic MySQL protocol (port 3306) and potentially the X Protocol (port 33060). Affected CPE is cpe:2.3:a:oracle_corporation:mysql_server across three active release trains (8.0 LTS, 8.4 Innovation, 9.x). One notable data discrepancy: the aggregator tag 'Authentication Bypass' conflicts with the CVSS PR:H rating, which requires existing high-privilege access - this tag may be a mis-categorization by secondary sources and should not be taken to imply unauthenticated bypass.

RemediationAI

The primary fix is to apply Oracle's April 2026 Critical Patch Update, which provides patched builds for all three affected release trains (8.0, 8.4, and 9.x); the exact fixed minor versions are not independently confirmed beyond the advisory reference at https://www.oracle.com/security-alerts/cpuapr2026.html. Users on Red Hat or SUSE distributions should apply vendor-provided MySQL package updates, as both are noted as reporters and likely carry patched RPMs or RPM-equivalent packages. If immediate patching is not feasible, compensating controls should focus on restricting who holds SUPER or SYSTEM_VARIABLES_ADMIN privileges - revoking these from any account that does not operationally require them eliminates the attack surface entirely without network-level changes. Network-level blocking of MySQL ports (3306, 33060) to untrusted hosts is a standard hardening measure but does not address the insider threat vector. Monitoring for unexpected privilege escalation or credential sharing can further reduce risk during a patching window.