What is the CVSS score of CVE-2026-47064?

CVE-2026-47064 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.3%.

Is there a patch available for CVE-2026-47064?

Yes, a patch is available for CVE-2026-47064. Update the affected software to the latest version immediately.

MySQL Server CVE-2026-47064

EUVD-2026-46550 MEDIUM

Improper Access Control (CWE-284)

2026-07-21 oracle

GHSA-vf2j-rrr9-c6jq

Authentication Bypass Oracle Red Hat Mysql Cluster Mysql Server Suse Oracle Corporation

6.5

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

6.5 MEDIUM

Network-reachable via multiple protocols with only low database credentials required; impact is purely availability (hang/crash) with no confidentiality or integrity effect.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

SUSE

MEDIUM

qualitative

Red Hat

6.5 MEDIUM

qualitative

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 02:31 vuln.today

CVE Published

Jul 21, 2026 - 21:33 nvd

MEDIUM 6.5

DescriptionCVE.org

Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and 9.7.0-9.7.1. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 6.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).

AnalysisAI

Denial of service in Oracle MySQL Server and MySQL Cluster allows any low-privileged authenticated attacker with network access to hang or repeatably crash the database service by exploiting a flaw in the Optimizer component. Affected deployments span MySQL Server 8.4.0-8.4.10 and 9.7.0-9.7.1, and MySQL Cluster 8.0.0-8.0.47, 8.4.0-8.4.10, and 9.7.0-9.7.1, per Oracle's July 2026 Critical Patch Update. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog; however, the low attack complexity and minimal privilege requirement make this a credible availability risk for any deployment with externally or internally accessible database accounts.

Technical ContextAI

The vulnerable component is the MySQL Optimizer - the query planning subsystem responsible for evaluating and selecting efficient execution strategies for SQL statements. Optimizer flaws typically arise from pathological or malformed query constructs that trigger undefined internal states, infinite planning loops, or memory safety violations during plan generation. The affected products are identified by CPEs cpe:2.3:a:oracle_corporation:mysql_server and cpe:2.3:a:oracle_corporation:mysql_cluster, covering both the standalone server and the distributed NDB Cluster variant used for high-availability deployments. No CWE has been assigned, which prevents definitive root-cause classification; however, the described impact - a repeatable hang or crash triggered by a low-privileged user - is consistent with CWE-400 (Uncontrolled Resource Consumption) or CWE-20 (Improper Input Validation) in query processing. The vulnerability is reachable via multiple MySQL protocols, including the standard MySQL wire protocol (TCP/3306) and potentially X Protocol (TCP/33060).

RemediationAI

Apply Oracle's Critical Patch Update for July 2026, available at https://www.oracle.com/security-alerts/cpujul2026.html. The exact patched version numbers are not specified in the available intelligence and must be confirmed directly from the Oracle CPU advisory - consult Oracle Support for the precise target versions for MySQL Server and MySQL Cluster. As an interim compensating control, restrict network access to MySQL ports (default 3306/TCP and 33060/TCP for X Protocol) to trusted application hosts only using host-based firewalls or security group rules, reducing the pool of principals who can reach the service. Enforce the principle of least privilege on database accounts - revoke unneeded query permissions from low-trust accounts to reduce the attack surface, noting that this may affect legitimate application functionality. For MySQL Cluster deployments, consider additional NDB management-layer access controls. These workarounds reduce but do not eliminate risk because the flaw is exploitable by any low-privileged authenticated user.