EUVD-2026-47293
GHSA-r585-44j5-rvx8
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Mirrors Oracle's published vector; network interception requires user-initiated connection (UI:R), no privileges or special configuration needed, confidentiality impact only with no integrity or availability effect.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
Lifecycle Timeline
2DescriptionCVE.org
Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/J). Supported versions that are affected are 9.7.0-9.7.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Connectors. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all MySQL Connectors accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N).
AnalysisAI
Unauthorized access to critical data is achievable against MySQL Connector/J versions 9.7.0 and 9.7.1 via a network-accessible authentication bypass flaw requiring human interaction. Oracle classifies this as easily exploitable, meaning a network-positioned unauthenticated attacker can intercept or otherwise obtain complete access to all data flowing through the affected connector when a legitimate application initiates a database connection. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
Technical ContextAI
MySQL Connector/J is Oracle's official JDBC (Java Database Connectivity) driver, enabling Java applications to connect to MySQL and MySQL-compatible database servers using multiple protocols (including the standard MySQL protocol over TCP). The affected versions are 9.7.0 and 9.7.1, which are recent releases in the 9.x connector generation. The vendor tag 'Authentication Bypass' combined with the CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) strongly suggests a flaw in how the connector establishes or validates the server identity or session security during the connection handshake - a class of vulnerability that could involve insufficient TLS certificate verification, server spoofing acceptance, or improper authentication challenge handling. The CWE is listed as N/A, which limits root-cause classification; however, Authentication Bypass patterns in JDBC drivers commonly manifest as failures in hostname verification or trust store enforcement. The 'multiple protocols' language in the Oracle description indicates the flaw is not confined to a single connection mode.
RemediationAI
Upgrade MySQL Connector/J to a version beyond 9.7.1 as specified in the Oracle Critical Patch Update for July 2026, available at https://www.oracle.com/security-alerts/cpujul2026.html. The exact fixed release version is not independently confirmed from the provided reference data; consult the Oracle CPU page directly to identify the minimum safe version. As an interim compensating control while patching, enforce explicit TLS certificate verification in all JDBC connection strings (e.g., verifyServerCertificate=true combined with a trusted CA truststore) to reduce the likelihood of server impersonation attacks; note this may require provisioning valid server certificates and could break connections to servers with self-signed certificates. Additionally, restrict network routing between Java application servers and MySQL instances to hardened, monitored network segments where ARP spoofing or DNS poisoning is mitigated, reducing the attacker's ability to achieve a man-in-the-middle position.
More in Mysql Connectors
View allServer or client applications that call the SSL_check_chain() function during or after a TLS 1.3 handshake may crash due
A vulnerability was found in Hibernate-Validator. Rated medium severity (CVSS 6.1), this vulnerability is remotely explo
In order to decrypt SM2 encrypted data an application is expected to call the API function EVP_PKEY_decrypt(). Rated cri
ASN.1 strings are represented internally within OpenSSL as an ASN1_STRING structure which contains a buffer holding the
Full takeover of Oracle MySQL Connector/Net (versions 9.7.0 and 9.7.1) is possible by a low-privileged network attacker
Due to the formatting logic of the "console.table()" function it was not safe to allow user controlled input to be passe
Full compromise ("takeover") of Oracle's MySQL Connector/NET client library affects the ADO.NET data provider in MySQL C
Vulnerability in the MySQL Connectors component of Oracle MySQL (subcomponent: Connector/Python). Rated high severity (C
Unauthorized data disclosure in Oracle MySQL Connector/J (the official MySQL JDBC driver) versions 9.7.0 through 9.7.1 a
Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/J). Rated high severity (CVSS 7.5),
Denial of service in Oracle MySQL Connector/C++ (MySQL Connectors component) versions 9.7.0 through 9.7.1 allows an unau
Unauthorized data access and modification in Oracle MySQL Connectors (Connector/C++) versions 9.7.0 through 9.7.1 lets a
Same weakness CWE-200 – Information Exposure
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today