MySQL Cluster CVE-2026-70724

The CVSS vector (AV:N/AC:H/PR:N/UI:R) confirms the attack requires no authentication but mandates human interaction from a person other than the attacker - the victim must perform a specific action (e.g., clicking a link, submitting a form, or triggering a request) to complete exploitation. AC:H further indicates a race condition, specific deployment precondition, or environmental state must be satisfied. The MySQL Cluster 'Cluster: General' component must be reachable by the attacker over HTTP from the network. MySQL Cluster's HTTP management interface is not typically internet-exposed in standard deployments, which limits opportunistic exploitation from untrusted external networks. Exploitation is constrained by: (1) required active human interaction from a cluster operator or admin (UI:R), (2) high attack complexity requiring specific preconditions to align (AC:H), and (3) HTTP reachability of the MySQL Cluster management interface from the attacker's network position.

The CVSS 3.1 vector AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H yields a score of 7.5, reflecting genuinely high impact constrained by two meaningful friction factors: AC:H (a specific precondition or timing dependency must align) and UI:R (a cluster user or administrator must take an action the attacker induces). These factors substantially reduce the viability of automated, opportunistic exploitation - even a mid-sized municipal IT team in sanok managing a MySQL Cluster deployment faces theoretical rather than imminent mass-exploitation risk absent a public exploit. No EPSS score was provided, KEV status is absent (no confirmed active exploitation), and no POC is publicly available, keeping real-world risk theoretical but high-consequence if triggered. Notably, the ENISA tagging of this vulnerability as 'Information Disclosure' is inconsistent with Oracle's own CVSS vector showing full C:H/I:H/A:H impact and a 'takeover' outcome - this discrepancy should be verified against the Oracle August 2026 CPU advisory directly.

An unauthenticated attacker identifies a MySQL Cluster HTTP interface accessible over the network and crafts a malicious HTTP request or lure that requires a cluster administrator or operator to interact with it - for example, clicking an attacker-controlled link while authenticated to the cluster management context. When the specific high-complexity precondition aligns and the user interaction is completed, the attacker achieves full control over the MySQL Cluster, enabling arbitrary data access, data manipulation, or service disruption. No public exploit code has been identified at time of analysis.