EUVD-2026-62018
GHSA-7j9m-3rwm-gq52
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Local vector confirmed by infrastructure logon requirement; PR:N reflects unprivileged local access; UI:R reflects mandatory third-party interaction; A:H reflects complete connector denial of service.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
Lifecycle Timeline
1DescriptionCVE.org
Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/ODBC). The supported version that is affected is 26.7.0. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where MySQL Connectors executes to compromise MySQL Connectors. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Connectors. CVSS 3.1 Base Score 5.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H).
AnalysisAI
MySQL Connector/ODBC version 26.7.0 exposes a local denial-of-service condition that allows an unauthenticated attacker with logon access to the host to cause a complete hang or repeatable crash of the connector, disrupting dependent applications. Exploitation requires human interaction from a third party (UI:R), constraining the realistic attack surface to insider threat or socially engineered scenarios on the affected host. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires local logon access to the host where MySQL Connector/ODBC 26.7.0 is installed (AV:L) - network-only access is insufficient. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 base score of 5.5 (Medium) reflects a genuinely constrained threat profile: local access (AV:L) is mandatory, human interaction from a non-attacker party is required (UI:R), and impact is exclusively availability-based (A:H, C:N, I:N). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the patch or updated release specified in Oracle's Critical Security Patch Update for August 2026, available at https://www.oracle.com/security-alerts/cspuaug2026.html. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-404 – Improper Resource Shutdown or Release
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today