EUVD-2026-46747
GHSA-43wq-jr44-wphj
Severity by source
AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
Local-only vector, high-privilege and high-complexity prerequisites confirmed by description; full CIA impact reflects 'takeover' outcome with unchanged scope.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
Lifecycle Timeline
2DescriptionCVE.org
Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Group Replication GCS). Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and 9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where MySQL Server, MySQL Cluster executes to compromise MySQL Server, MySQL Cluster. Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 6.4 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H).
AnalysisAI
Full takeover of Oracle MySQL Server and MySQL Cluster is achievable by a high-privileged local attacker exploiting a flaw in the Group Replication Group Communication System (GCS) component across multiple supported release trains. Affected deployments span MySQL Server 8.4.x and 9.7.x, and MySQL Cluster 8.0.x, 8.4.x, and 9.7.x. Despite the CVSS score of 6.4 being mid-range, the CIA impact triple (C:H/I:H/A:H) indicates complete compromise of the database instance; however, the local attack vector (AV:L), high complexity (AC:H), and high privilege requirement (PR:H) substantially constrain real-world exploitation. No public exploit code or CISA KEV listing has been identified at time of analysis.
Technical ContextAI
The vulnerability resides in the Group Communication System (GCS) layer of MySQL Group Replication, which is the internal messaging and consensus subsystem used to coordinate replicated database nodes. GCS is responsible for reliable multicast, view management, and failure detection between cluster members. The affected CPE scope covers oracle:mysql in versions 8.0.0-8.0.47 (Cluster only), 8.4.0-8.4.10, and 9.7.0-9.7.1 across both MySQL Server and MySQL Cluster product lines. No CWE has been assigned by Oracle or NVD, which limits root-cause classification; however, the 'takeover' outcome with a local, high-complexity, high-privilege vector is consistent with a memory corruption, privilege escalation within the mysqld process boundary, or a configuration manipulation flaw within the GCS message-handling code path. The CVSS scope is Unchanged (S:U), meaning the impact is contained to the MySQL instance itself rather than escaping to the host OS.
RemediationAI
Apply the fixes delivered in Oracle's Critical Patch Update for July 2026, available at https://www.oracle.com/security-alerts/cpujul2026.html. The advisory addresses affected MySQL Server versions through 8.4.10 and 9.7.1 - consult the CPU table for the exact patched release in each stream, as specific fix version numbers are not enumerated in the currently available data. For MySQL Cluster 8.0.x (8.0.0-8.0.47), apply the corresponding CPU patch for that branch. As an interim compensating control, restrict OS-level logon to MySQL hosts to only those accounts strictly required, using sudo policies, PAM rules, or host-based access controls, since AV:L means no remote exploitation path exists - reducing local logon access directly eliminates the attack surface. Disabling Group Replication on instances that do not require it eliminates exposure to the GCS component entirely, but this has operational trade-offs for HA and read-scale configurations. Monitor for unauthorized local access or unexpected mysqld privilege escalations as detection controls.
More in Mysql Server
View allA heap buffer overflow in the TFTP receiving code allows for DoS or arbitrary code execution in libcurl versions 7.19.4
XStream is a Java library to serialize objects to XML and back again. Rated critical severity (CVSS 9.8), this vulnerabi
libcurl versions from 7.36.0 to before 7.64.0 are vulnerable to a stack-based buffer overflow. Rated critical severity (
When sending data to an MQTT server, libcurl <= 7.73.0 and 7.78.0 could in some circumstances erroneously keep a pointer
XStream is a Java library to serialize objects to XML and back again. Rated critical severity (CVSS 9.1), this vulnerabi
A use of incorrectly resolved name vulnerability fixed in 7.83.1 might remove the wrong file when `--no-clobber` is used
curl 7.75.0 through 7.76.1 suffers from a use-after-free vulnerability resulting in already freed memory being used when
libcurl-using applications can ask for a specific client certificate to be used in a transfer. Rated high severity (CVSS
A user can tell curl >= 7.20.0 and <= 7.78.0 to require a successful upgrade to TLS when speaking to an IMAP, POP3 or FT
Heap buffer overflow in the TFTP protocol handler in cURL 7.19.4 to 7.65.3. Rated critical severity (CVSS 9.8), this vul
A vulnerability was found in Hibernate-Validator. Rated medium severity (CVSS 6.1), this vulnerability is remotely explo
When curl is instructed to download content using the metalink feature, thecontents is verified against a hash provided
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allVendor StatusVendor
SUSE
Severity: Moderate| Product | Status |
|---|---|
| SUSE Liberty Linux 10 | Fixed |
| SUSE Liberty Linux 8 | Fixed |
| SUSE Liberty Linux 9 | Fixed |
Share
External POC / Exploit Code
Leaving vuln.today