What is the CVSS score of CVE-2026-35238?

CVE-2026-35238 has a CVSS 3.1 base score of 4.9 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-35238?

Yes, a patch is available for CVE-2026-35238. Update the affected software to the latest version immediately.

MySQL Server CVE-2026-35238

EUVD-2026-24442 MEDIUM

Improper Access Control (CWE-284)

2026-04-21 oracle

GHSA-c2pf-f8x2-95m2

Authentication Bypass Oracle Mysql Server Oracle Corporation

4.9

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.9 MEDIUM

AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

4.9 MEDIUM

Network-reachable but requires high-privilege credentials; impact is availability-only via crash or hang, with no confidentiality or integrity loss.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

SUSE

MEDIUM

qualitative

Red Hat

4.9 MEDIUM

qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 24, 2026 - 06:04 vuln.today

EUVD ID Assigned

Apr 21, 2026 - 21:01 euvd

EUVD-2026-24442

CVE Published

Apr 21, 2026 - 20:35 nvd

MEDIUM 4.9

DescriptionCVE.org

Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.0-8.0.45, 8.4.0-8.4.8 and 9.0.0-9.6.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).

AnalysisAI

Denial-of-service in MySQL Server's InnoDB component allows a high-privileged authenticated attacker with network access to cause a hang or frequently repeatable crash of the database server across versions 8.0.0-8.0.45, 8.4.0-8.4.8, and 9.0.0-9.6.0. Impact is confined to availability - no data exfiltration or integrity compromise is possible through this vector. No public exploit has been identified at time of analysis, and EPSS probability of 0.04% (11th percentile) is consistent with SSVC's confirmed zero observed exploitation, placing this firmly in the lower-priority patch tier for most organizations.

Technical ContextAI

The vulnerability resides in InnoDB, MySQL Server's default transactional storage engine responsible for row-level locking, multi-version concurrency control (MVCC), and crash recovery. Because InnoDB is enabled by default, virtually all MySQL deployments expose this component. The assigned CWE-284 (Improper Access Control) indicates the root cause is a failure to properly enforce access boundaries within the InnoDB subsystem, allowing a privileged but otherwise legitimate operation to transition the engine into an unrecoverable or crash-inducing state. Affected CPE is cpe:2.3:a:oracle_corporation:mysql_server across three version families. Notably, the intelligence tags include 'Authentication Bypass,' which is in direct tension with the PR:H CVSS assignment - this tag may reflect a misclassification by an aggregator, a co-located issue in the same Oracle CPU advisory batch, or secondary metadata from Red Hat or SUSE triage. It should not be taken to mean unauthenticated exploitation is possible without vendor confirmation.

RemediationAI

Apply Oracle's patch released in the April 2026 Critical Patch Update, available at https://www.oracle.com/security-alerts/cpuapr2026.html. Patch availability is confirmed by the vendor, but exact fixed build numbers are not specified in the available intelligence data - consult the advisory directly to identify the precise target version for each release family (post-8.0.45 for 8.0.x, post-8.4.8 for 8.4.x, and post-9.6.0 for 9.x). Red Hat and SUSE customers should apply updated MySQL packages through their respective subscription channels once available. As a compensating control prior to patching, restrict high-privilege MySQL account bindings to only trusted hosts using MySQL's GRANT ... IDENTIFIED BY ... syntax combined with firewall rules limiting inbound MySQL port (default 3306/3306) access to authorized DBA workstations and application servers only - this does not eliminate the vulnerability but eliminates network-reachability for the required PR:H credential class from untrusted networks.