What is the CVSS score of CVE-2026-46863?

CVE-2026-46863 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.5%.

Which versions of MySQL Server are affected by CVE-2026-46863?

Critical database unavailability risk exists for organizations running Oracle MySQL Server versions 8.0.x, 8.4.x, and 9.0.0-9.7.0, which can be remotely triggered by unauthenticated attackers without…. A patch is available.

How to fix or mitigate CVE-2026-46863?

Within 24 hours: Conduct inventory of all MySQL deployments, identify systems running versions 8.0.x, 8.4.x, or 9.0.0-9.7.0, and document criticality/dependencies. Within 7 days: Implement network segmentation restricting MySQL port access to essential applications only; deploy connection anomaly detection and rate limiting on affected systems; establish alert thresholds for connection handling crashes. Within 30 days: Execute patching plan when Oracle releases fix (subscribe to Oracle Critical Patch Updates); prioritize production database remediation; validate backup and failover procedures; test patches in staging before production deployment.

MySQL Server CVE-2026-46863

EUVD-2026-37356 HIGH

Uncontrolled Resource Consumption (CWE-400)

2026-06-16 oracle

Denial Of Service Oracle Mysql Server Mysql Cluster

7.5

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

7.5 HIGH

Oracle confirms unauthenticated network reach over multiple protocols with no user interaction and DoS-only impact, so A:H with C:N/I:N and PR:N/UI:N are appropriate.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 16, 2026 - 22:38 vuln.today

DescriptionCVE.org

Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Connection Handling). Supported versions that are affected are MySQL Server: 8.4.0-8.4.9, 9.0.0-9.7.0; MySQL Cluster: 8.0.11-8.0.46, 8.4.0-8.4.9 and 9.0.0-9.7.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).

AnalysisAI

Remote unauthenticated denial-of-service in Oracle MySQL Server and MySQL Cluster (8.0.x, 8.4.x, and 9.0.0-9.7.0) allows network attackers to trigger a hang or repeatable crash of the database via the Server Connection Handling component. Oracle rates the issue as easily exploitable over multiple protocols with no authentication or user interaction, producing a complete availability loss (CVSS 7.5, A:H only). No public exploit identified at time of analysis and the issue is not listed in CISA KEV.

Technical ContextAI

The flaw is in the MySQL Server Connection Handling subsystem, the layer that accepts inbound client sessions over MySQL protocols (classic MySQL protocol on 3306, MySQL X Protocol on 33060, and in Cluster builds the NDB management/data ports). Per the CPE data (cpe:2.3:a:oracle_corporation:mysql_server and :mysql_cluster) both the standalone Server and the Cluster (NDB) distributions share this code path, which is why three release trains (8.0 Cluster, 8.4, and 9.x innovation) are all affected. No CWE was assigned by Oracle, but the symptom profile - unauthenticated network input causing a hang or deterministic crash with no confidentiality or integrity impact - is characteristic of CWE-400/CWE-617 class bugs (uncontrolled resource consumption or reachable assertion) in the pre-authentication handshake or connection state machine.

RemediationAI

Apply the fixes shipped in Oracle's June 2026 Critical Patch Update (https://www.oracle.com/security-alerts/cspujun2026.html); Oracle did not publish an exact fixed point release in the input data, so consult the CPU matrix for the specific 8.4.x, 9.7.x, and 8.0.x NDB build that supersedes the affected ranges (Patch available per vendor advisory; exact fix version to be confirmed from the CPU). Until patches are deployed, restrict network reachability of TCP 3306 and 33060 (and NDB management port 1186 plus data node ports for Cluster) to known application hosts via firewall or security group rules, place MySQL behind a bastion or VPN, and consider front-ending with a proxy such as ProxySQL or MySQL Router that can rate-limit or drop malformed handshakes - note these controls reduce exposure but do not eliminate risk from compromised application tier hosts. Enable connection monitoring and automatic restart (systemd Restart=on-failure or orchestrator-managed failover) so a repeatable crash does not cause prolonged outage, and avoid exposing MySQL directly to the internet under any circumstance.