What is the CVSS score of CVE-2026-46936?

CVE-2026-46936 has a CVSS 3.1 base score of 4.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.3%.

Is there a patch available for CVE-2026-46936?

Yes, a patch is available for CVE-2026-46936. Update the affected software to the latest version immediately.

MySQL Server CVE-2026-46936

EUVD-2026-46462 MEDIUM

Improper Access Control (CWE-284)

2026-07-21 oracle

GHSA-7535-7fg5-3c9x

Oracle Mysql Server Mysql Cluster Authentication Bypass Red Hat Suse

4.4

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

4.4 MEDIUM

AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

4.4 MEDIUM

Network-accessible DDL component requires administrative-level DB credentials (PR:H) and difficult exploitation conditions (AC:H); impact is exclusively availability with no scope change.

3.1 AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:H/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

SUSE

MEDIUM

qualitative

Red Hat

4.4 MEDIUM

qualitative

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

High

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 01:59 vuln.today

CVE Published

Jul 21, 2026 - 21:32 nvd

MEDIUM 4.4

DescriptionCVE.org

Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: DDL). Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and 9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H).

AnalysisAI

Denial-of-service in Oracle MySQL Server and MySQL Cluster's DDL component allows a high-privileged, network-connected attacker to cause a complete server hang or repeatable crash under difficult-to-reproduce conditions. Affected product lines span MySQL Server 8.4.x and 9.7.x and MySQL Cluster 8.0.x through 9.7.x, as confirmed in Oracle's July 2026 Critical Patch Update (EUVD-2026-46462). No public exploit or confirmed active exploitation has been identified at time of analysis.

Technical ContextAI

The affected component is the DDL (Data Definition Language) subsystem of MySQL Server and MySQL Cluster - the engine responsible for processing schema-modifying statements such as CREATE, ALTER, DROP, and TRUNCATE. A crafted DDL operation submitted under specific conditions can cause the database process to enter an unresponsive hang state or crash repeatedly, constituting complete availability loss. CPE identifiers cpe:2.3:a:oracle_corporation:mysql_server and cpe:2.3:a:oracle_corporation:mysql_cluster confirm both product families are in scope. No CWE has been assigned by Oracle or NVD; however, the symptom profile - a server crash triggered by a specific DDL input - is consistent with improper input validation (analogous to CWE-20) or an uncontrolled resource consumption pattern (analogous to CWE-400) within the DDL parser or execution layer. MySQL Cluster introduces additional distributed coordination complexity (NDB storage engine), which may expand the attack surface for this class of DDL-induced failure.

RemediationAI

Apply Oracle's July 2026 Critical Patch Update, detailed at https://www.oracle.com/security-alerts/cpujul2026.html, which addresses this vulnerability across all affected MySQL Server and MySQL Cluster version lines. Exact fixed versions are not independently confirmed here - consult the Oracle advisory for the specific target upgrade versions within the 8.4.x, 8.0.x, and 9.7.x branches. If immediate patching is not feasible, restrict network-level access to the MySQL server port (default TCP 3306) using host-based or network firewall rules to permit connections only from trusted administrative hosts, reducing the pool of potential exploiters to those who already hold high-privileged credentials. Additionally, apply the principle of least privilege to DDL execution rights - revoke CREATE, ALTER, and DROP privileges from any account that does not operationally require them, as exploitation is gated behind high-privileged access. Note that firewall restrictions do not eliminate risk if the threat model includes compromised DBA accounts already authorized for network access.