What is the CVSS score of EUVD-2026-37354?

EUVD-2026-37354 has a CVSS 3.1 base score of 9.6 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N. EPSS exploitation probability: 0.4%.

Which versions of MySQL NDB Cluster are affected by EUVD-2026-37354?

Oracle MySQL NDB Cluster versions 8.0.11-8.0.46, 8.4.0-8.4.9, and 9.0.0-9.7.0 contain a critical vulnerability enabling remote attackers to achieve complete data compromise-reading, modifying,…

How to fix or mitigate EUVD-2026-37354?

Within 24 hours: Identify and inventory all MySQL NDB Cluster instances in production and non-production environments, documenting which are running affected versions (8.0.11-8.0.46, 8.4.0-8.4.9, 9.0.0-9.7.0). Within 7 days: Implement network segmentation to restrict HTTP access to the NDB Operator component to trusted administrative networks only; disable HTTP access to NDB Operator if alternative management protocols support operational requirements. Within 30 days: Establish formal communication with Oracle support to confirm patch release timeline; prepare contingency plan for operational isolation or version migration of affected clusters pending patch availability.

MySQL NDB Cluster EUVD-2026-37354

| CVE-2026-46861 CRITICAL

Improper Access Control (CWE-284)

2026-06-16 oracle

Authentication Bypass Oracle Mysql Ndb Cluster Oracle Corporation

9.6

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

9.6 CRITICAL

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N

vuln.today AI

9.6 CRITICAL

HTTP-reachable operator endpoint gives AV:N/AC:L; low-privileged creds required so PR:L; no user interaction; scope-change crosses into managed cluster data with full C/I impact and no availability effect.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 16, 2026 - 22:39 vuln.today

CVE Published

Jun 16, 2026 - 19:27 cve.org

CRITICAL 9.6

DescriptionCVE.org

Vulnerability in the MySQL NDB Cluster product of Oracle MySQL (component: Cluster: NDB Operator). Supported versions that are affected are 8.0.11-8.0.46, 8.4.0-8.4.9 and 9.0.0-9.7.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise MySQL NDB Cluster. While the vulnerability is in MySQL NDB Cluster, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all MySQL NDB Cluster accessible data as well as unauthorized access to critical data or complete access to all MySQL NDB Cluster accessible data. CVSS 3.1 Base Score 9.6 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N).

AnalysisAI

Cross-component compromise in Oracle MySQL NDB Cluster (versions 8.0.11-8.0.46, 8.4.0-8.4.9, and 9.0.0-9.7.0) allows a low-privileged remote attacker with HTTP access to the NDB Operator component to read, modify, create, or delete all data accessible to the cluster. The scope-changed nature (S:C) means successful attacks reach beyond the NDB Cluster boundary into adjacent products. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV, but Oracle's CVSS 9.6 rating and 'easily exploitable' characterization make this a high-priority patch.

Technical ContextAI

MySQL NDB Cluster is Oracle's distributed, shared-nothing, in-memory database engine used for high-availability OLTP workloads, and the NDB Operator is the Kubernetes operator that orchestrates NDB Cluster deployments on container platforms. The vulnerable component is reached over HTTP (consistent with the operator's Kubernetes API-facing control plane), and the scope-change indicator (S:C) suggests the flaw lets an attacker pivot from the operator's security authority into managed cluster resources or adjacent workloads. No CWE was assigned by NVD; the 'Authentication Bypass' tag from threat-intel feeds combined with PR:L (some authentication required) suggests a privilege-elevation or authorization-check failure within the operator's HTTP control surface rather than a fully unauthenticated bypass.

RemediationAI

Apply the fixed releases shipped in Oracle's June 2026 Critical Patch Update (https://www.oracle.com/security-alerts/cspujun2026.html) - upgrade past 8.0.46 on the 8.0 train, past 8.4.9 on the 8.4 train, and past 9.7.0 on the 9.x train (exact fixed build numbers should be taken directly from the Oracle advisory rather than inferred). If immediate patching is not feasible, restrict network reachability of the NDB Operator's HTTP control endpoint to a trusted management network and tighten Kubernetes RBAC so that only a minimal set of service accounts can authenticate to the operator (this reduces the pool of 'low-privileged' actors who can reach the vulnerable code path, at the cost of breaking automation that previously relied on broader access). Audit operator and cluster logs for unexpected HTTP calls against the NDB Operator and for unauthorized data modifications in NDB tables as a compensating detection control.