What is the CVSS score of CVE-2026-35237?

CVE-2026-35237 has a CVSS 3.1 base score of 4.9 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-35237?

Yes, a patch is available for CVE-2026-35237. Update the affected software to the latest version immediately.

MySQL Server CVE-2026-35237

EUVD-2026-24441 MEDIUM

Improper Access Control (CWE-284)

2026-04-21 oracle

GHSA-93m8-r373-2q8w

Authentication Bypass Oracle Mysql Server

4.9

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.9 MEDIUM

AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

4.9 MEDIUM

Network-reachable but requires high DB privileges (PR:H); no scope change, no confidentiality or integrity impact - availability-only crash.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

SUSE

MEDIUM

qualitative

Red Hat

4.9 MEDIUM

qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 24, 2026 - 06:04 vuln.today

EUVD ID Assigned

Apr 21, 2026 - 21:01 euvd

EUVD-2026-24441

CVE Published

Apr 21, 2026 - 20:35 nvd

MEDIUM 4.9

DescriptionCVE.org

Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.0-8.0.45, 8.4.0-8.4.8 and 9.0.0-9.6.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).

AnalysisAI

Denial-of-service in MySQL Server's InnoDB storage engine allows a high-privileged, network-authenticated attacker to hang or repeatedly crash the database server across all major release trains (8.0.x, 8.4.x, and 9.x). The vulnerability is reachable over multiple network protocols without user interaction, making it exploitable by any account holding high database privileges (e.g., DBA or SUPER). No public exploit code has been identified and CISA has not added this to the Known Exploited Vulnerabilities catalog, consistent with an EPSS score of just 0.04%.

Technical ContextAI

The affected component is InnoDB, MySQL's default transactional storage engine responsible for row-level locking, MVCC, crash recovery, and the buffer pool. Per CPE cpe:2.3:a:oracle_corporation:mysql_server, the issue spans all branches from 8.0.0 through 8.0.45, 8.4.0 through 8.4.8, and 9.0.0 through 9.6.0. CWE-284 (Improper Access Control) indicates that InnoDB fails to appropriately restrict a privileged operation, allowing a caller to trigger an uncontrolled server state - a hang or crash - through a malformed or abusive request sent via any of MySQL's supported wire protocols (TCP/IP, Unix socket, named pipe, etc.). Note: the 'Authentication Bypass' tag present in the VulDB feed is inconsistent with the CVSS PR:H metric reported by Oracle and NVD; this tag likely reflects a tagging artifact rather than a confirmed authentication-bypass capability and should not be relied upon without vendor clarification.

RemediationAI

Oracle has released patches for all three affected release trains as part of the Critical Patch Update (CPU) for April 2026, available at https://www.oracle.com/security-alerts/cpuapr2026.html. Administrators should upgrade to the first unaffected release in each train - that is, beyond 8.0.45 for the 8.0 branch, beyond 8.4.8 for the 8.4 branch, and beyond 9.6.0 for the 9.x branch - however exact fixed version numbers are not explicitly named in the available advisory data and should be confirmed directly from the Oracle CPU before deployment. Red Hat and SUSE package maintainers (referenced in vendor tags) are expected to issue updated RPM/DEB packages; downstream consumers should apply distributor-specific updates once available. As a compensating control pending patching, restrict high-privileged MySQL account usage to trusted administrative hosts only using MySQL's GRANT ... REQUIRE ... or host-based access controls, and audit for accounts holding SUPER or SYSTEM_VARIABLES_ADMIN privileges. The trade-off is added operational friction for legitimate DBA activity.