What is the CVSS score of CVE-2026-35239?

CVE-2026-35239 has a CVSS 3.1 base score of 4.9 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-35239?

Yes, a patch is available for CVE-2026-35239. Update the affected software to the latest version immediately.

MySQL Server CVE-2026-35239

EUVD-2026-24443 MEDIUM

Improper Access Control (CWE-284)

2026-04-21 oracle

Authentication Bypass Oracle Mysql Server Oracle Corporation

4.9

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.9 MEDIUM

AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

4.9 MEDIUM

Network access via multiple protocols (AV:N), no complexity or interaction required, but high privileges gate exploitation (PR:H); impact is availability-only (A:H, C:N, I:N).

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

SUSE

MEDIUM

qualitative

Red Hat

4.9 MEDIUM

qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 24, 2026 - 06:03 vuln.today

EUVD ID Assigned

Apr 21, 2026 - 21:01 euvd

EUVD-2026-24443

CVE Published

Apr 21, 2026 - 20:35 nvd

MEDIUM 4.9

DescriptionCVE.org

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DML). Supported versions that are affected are 8.0.0-8.0.45, 8.4.0-8.4.8 and 9.0.0-9.6.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).

AnalysisAI

Denial-of-service exposure in Oracle MySQL Server's DML (Data Manipulation Language) component allows a high-privileged, network-authenticated attacker to cause a complete, repeatable crash or hang of the database server. Affected across three active release trains - 8.0.0 through 8.0.45, 8.4.0 through 8.4.8, and 9.0.0 through 9.6.0 - the vulnerability is exploitable over multiple network protocols without user interaction. No public exploit exists and the vulnerability is not listed in CISA KEV; EPSS at 0.04% (11th percentile) confirms very low exploitation activity at time of analysis.

Technical ContextAI

The flaw resides in the DML processing subsystem of MySQL Server, the component responsible for INSERT, UPDATE, DELETE, and related query execution. The root cause class is CWE-284 (Improper Access Control), which in the DML context typically manifests as insufficient validation or authorization enforcement over specific query constructs that can trigger unbounded resource consumption or assertion failures in the server process. The CPE string cpe:2.3:a:oracle_corporation:mysql_server covers all three affected version lines (8.0.x, 8.4.x, 9.x). The vulnerability is reachable via multiple protocols, consistent with MySQL's support for TCP/IP, Unix socket, and named pipes - and by implication over MySQL protocol clients, JDBC/ODBC connectors, and replication channels. The inclusion of Red Hat and SUSE in the tags indicates that downstream Linux distribution packages are also affected, broadening the remediation surface.

RemediationAI

Upgrade to the next released version beyond the confirmed affected ranges: for the 8.0 train, upgrade beyond 8.0.45; for the 8.4 train, beyond 8.4.8; for the 9.x train, beyond 9.6.0. The Oracle April 2026 CPU advisory (https://www.oracle.com/security-alerts/cpuapr2026.html) is the authoritative source for exact patched version numbers, which are not independently confirmed in the available input data beyond the affected-version ceiling. Red Hat and SUSE customers should apply the corresponding distribution updates. As a compensating control where immediate upgrade is not possible, restrict DBA and SUPER-privileged accounts to trusted source IPs via firewall rules or MySQL's host-based access controls - this limits the attacker's ability to reach the vulnerable DML code path without first compromising a privileged account. Note that this control does not eliminate the vulnerability but reduces the network-accessible attack surface.