What is the CVSS score of CVE-2026-35240?

CVE-2026-35240 has a CVSS 3.1 base score of 4.9 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-35240?

Yes, a patch is available for CVE-2026-35240. Update the affected software to the latest version immediately.

MySQL Server CVE-2026-35240

EUVD-2026-24445 MEDIUM

Improper Access Control (CWE-284)

2026-04-21 oracle

Authentication Bypass Oracle Mysql Server Oracle Corporation

4.9

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.9 MEDIUM

AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

4.9 MEDIUM

PR:H reflects mandatory DBA-level authentication; A:H captures complete server crash/hang; no confidentiality or integrity impact exists.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

SUSE

MEDIUM

qualitative

Red Hat

4.9 MEDIUM

qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 24, 2026 - 06:03 vuln.today

EUVD ID Assigned

Apr 21, 2026 - 21:01 euvd

EUVD-2026-24445

CVE Published

Apr 21, 2026 - 20:35 nvd

MEDIUM 4.9

DescriptionCVE.org

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.0-8.0.45, 8.4.0-8.4.8 and 9.0.0-9.6.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).

AnalysisAI

Denial-of-service in MySQL Server's Optimizer component allows a high-privileged network attacker to hang or repeatedly crash the database engine across three major release branches (8.0.x through 8.0.45, 8.4.x through 8.4.8, and 9.0.x through 9.6.0). Exploitation requires a high-privilege database account (DBA-level), but once authenticated, the attack is low-complexity and requires no user interaction - Oracle's advisory describes it as 'easily exploitable' in that context. No public exploit code or active exploitation has been identified; EPSS of 0.04% (11th percentile) and SSVC exploitation rating of 'none' together indicate this poses negligible real-world exploitation risk at time of analysis.

Technical ContextAI

The vulnerability resides in the Optimizer subcomponent of MySQL Server, which is responsible for generating and executing query execution plans. The assigned CWE-284 (Improper Access Control) suggests a logic flaw in how the Optimizer handles or validates certain inputs, likely crafted SQL constructs that the execution engine cannot safely process, leading to an uncontrolled hang or crash. The CPE string cpe:2.3:a:oracle_corporation:mysql_server covers the Oracle-distributed MySQL packages, and the affected range spans all three actively maintained branches: 8.0 (LTS), 8.4 (Innovation), and the 9.x series. Notably, the metadata tags include 'Authentication Bypass' - this is inconsistent with the CVSS PR:H vector and may reflect an erroneous tag; the authoritative Oracle description and CVSS vector require high privileges and do not describe any authentication bypass path. Red Hat and SUSE are also tagged, indicating downstream Linux distribution advisories are expected or already issued.

RemediationAI

A vendor-supplied patch is available per the Oracle CPU April 2026 advisory (https://www.oracle.com/security-alerts/cpuapr2026.html); organizations should upgrade to a fixed version beyond the affected ranges (above 8.0.45 for the 8.0 branch, above 8.4.8 for the 8.4 branch, and above 9.6.0 for the 9.x branch), but exact patched version numbers were not independently confirmed in the available data - consult the Oracle advisory directly for confirmed target versions. As a compensating control prior to patching, organizations can restrict network access to MySQL listener ports at the firewall to only trusted, high-privilege administrative hosts, reducing the attack surface to local or bastion-host sessions; this trades operational convenience for reduced exposure. Because exploitation requires a high-privilege database account, enforcing least-privilege access controls and monitoring for unexpected DBA-level logins provides a meaningful compensating layer.