Mysql Cluster
Monthly
Full takeover of MySQL Server and MySQL Cluster is possible for unauthenticated attackers who can reach the Group Replication communication segment, affecting MySQL Server 8.4.0-8.4.12, 9.7.0-9.7.3 and 26.7.0-26.7.1 plus MySQL Cluster 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and 26.7.0-26.7.1. The flaw is in the Server: Group Replication GCS component and yields high confidentiality, integrity and availability impact (CVSS 8.8, AV:A/AC:L/PR:N/UI:N). Exploitation is limited to deployments running Group Replication and to attackers on the adjacent physical communication segment; no public exploit was identified at time of analysis and CISA KEV status is not indicated.
Unauthenticated remote attackers can corrupt or destroy data and trigger repeatable crashes of MySQL Server and MySQL Cluster through the Server: Replication component, affecting Server 8.4.0-8.4.12, 9.7.0-9.7.3 and 26.7.0-26.7.1 and Cluster 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and 26.7.0-26.7.1. Oracle rates it 7.4 (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H), explicitly calling it difficult to exploit, so success likely hinges on specific replication state, timing or race conditions rather than a single crafted request, and there is no confidentiality impact - the exposure is unauthorized creation, deletion or modification of critical data plus a hang or frequently repeatable full denial of service. No public exploit code or confirmed active exploitation was identified at time of analysis, and this is best treated as a genuine but second-tier priority concentrated on database nodes whose ports are network-reachable.
Unauthenticated attackers with access to the same layer-2 network segment as a MySQL Server or MySQL Cluster node running the Group Replication plugin can trigger a hang or frequently repeatable full crash (denial of service) and make limited unauthorized data changes, yielding a 7.1 CVSS score (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H). Exposure is narrow by design: the Group Replication plugin must be actively configured as part of a replication topology, which is not the default for standalone installations, and the attacker must sit on the adjacent broadcast domain or VLAN rather than reaching the host over the internet. No public exploit code has been identified at time of analysis, and the issue is not listed in CISA KEV; the practical risk is bounded far more by network adjacency and the non-default clustering configuration than by the raw score.
Unauthenticated, network-reachable attackers can potentially take over MySQL Server and MySQL Cluster through a high-complexity flaw in the 'Client programs' component, with full confidentiality, integrity, and availability impact. The issue affects MySQL Server 8.4.0-8.4.12, 9.7.0-9.7.3, and 26.7.0-26.7.1 plus MySQL Cluster 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3, and 26.7.0-26.7.1; Oracle rates it difficult to exploit (AC:H) and no public exploit identified at time of analysis.
Takeover of Oracle MySQL Server and MySQL Cluster can result when a client program connects to an attacker-controlled, rogue, or intercepted MySQL endpoint, exploiting a difficult-to-trigger flaw in the client programs component. Affected releases include MySQL Server 8.4.0-8.4.12, 9.7.0-9.7.3, and 26.7.0-26.7.1, plus MySQL Cluster 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3, and 26.7.0-26.7.1. Oracle rates it CVSS 8.1 with high confidentiality, integrity, and availability impact; the vector requires network access with no privileges, and high attack complexity reflects the need for server impersonation or interception, with no public exploit identified at time of analysis.
Oracle MySQL Server and MySQL Cluster client programs (MySQL Server 8.4.0-8.4.12, 9.7.0-9.7.3 and 26.7.0-26.7.1; MySQL Cluster 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and 26.7.0-26.7.1) harbor a high-complexity flaw that an unauthenticated network attacker can use to achieve full confidentiality, integrity and availability impact on a MySQL client, amounting to takeover in the assessed scope. Exploitation is constrained because the victim client must connect to an attacker-controlled or attacker-influenced server endpoint over one of the supported protocols, and Oracle rates the issue 'difficult to exploit' (AC:H). No public exploit was identified at time of analysis and no CISA KEV entry is present; CVSS 3.1 base score is 8.1.
Full takeover of Oracle MySQL Cluster is achievable by an unauthenticated remote attacker over HTTP across three active release trains: 8.0.0-8.0.48, 8.4.0-8.4.11, and 9.7.0-9.7.2. The attack carries high complexity and requires human interaction from a victim user, but successful exploitation yields complete confidentiality, integrity, and availability compromise of the cluster. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Remote unauthenticated denial-of-service and partial data integrity compromise in Oracle MySQL Cluster's NDB Operator component allows network attackers to crash or hang the cluster and perform unauthorized data modifications. Affected versions span three active release lines: 8.0.0-8.0.47, 8.4.0-8.4.10, and 9.7.0-9.7.1. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog, but the low attack complexity and zero authentication requirement make exploitation straightforward against exposed deployments.
Takeover of MySQL Server and MySQL Cluster is possible through the Server: Replication component, where a high-privileged attacker with network access can fully compromise affected instances. This authenticated flaw affects MySQL Server 8.4.0-8.4.10 and 9.7.0-9.7.1, and MySQL Cluster 8.0.0-8.0.47, 8.4.0-8.4.10 and 9.7.0-9.7.1, and is fixed in Oracle's July 2026 Critical Patch Update. Oracle rates it CVSS 7.2 with full confidentiality, integrity and availability impact; no public exploit identified at time of analysis.
Full takeover of Oracle MySQL Server and MySQL Cluster is possible through the Server: X Plugin component, allowing a high-privileged attacker with network access via multiple protocols to compromise confidentiality, integrity, and availability. Affected builds include MySQL Server 8.4.0-8.4.10 and 9.7.0-9.7.1, plus MySQL Cluster 8.0.0-8.0.47, 8.4.0-8.4.10 and 9.7.0-9.7.1. There is no public exploit identified at time of analysis and the flaw is not on the CISA KEV list, though Oracle rates it as easily exploitable once the required high privileges are held.
Remote unauthenticated denial-of-service and partial information disclosure affects Oracle MySQL Server 8.4.0-8.4.10 and 9.7.0-9.7.1 (and MySQL Cluster 8.0.0-8.0.47, 8.4.0-8.4.10, 9.7.0-9.7.1) through the Server: X Plugin component. An attacker with only network access, using multiple protocols, can trigger a hang or repeatable crash (complete DoS) and read a subset of accessible data, carrying an Oracle-assigned CVSS 3.1 score of 8.2. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Full takeover of Oracle MySQL Server and MySQL Cluster is possible through the Server: Group Replication Plugin, where a local attacker holding only a logon to the host running the database can compromise the instance without any database credentials. The flaw affects MySQL Server 8.4.0-8.4.10 and 9.7.0-9.7.1, plus MySQL Cluster 8.0.0-8.0.47, 8.4.0-8.4.10 and 9.7.0-9.7.1, and carries a CVSS 3.1 base score of 8.4 with high confidentiality, integrity and availability impact. No public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Remote unauthenticated denial-of-service in Oracle MySQL Server and MySQL Cluster (8.0.x, 8.4.x, and 9.0.0-9.7.0) allows network attackers to trigger a hang or repeatable crash of the database via the Server Connection Handling component. Oracle rates the issue as easily exploitable over multiple protocols with no authentication or user interaction, producing a complete availability loss (CVSS 7.5, A:H only). No public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Repeated-crash denial of service in Oracle MySQL Server (X Plugin component) and MySQL Cluster allows a low-privileged, network-positioned user to hang or fully take down the database service. Affected builds are MySQL Server 8.4.0-8.4.12, 9.7.0-9.7.3 and 26.7.0-26.7.1, plus MySQL Cluster 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and 26.7.0-26.7.1. Oracle rates it CVSS 3.1 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), meaning the attacker must already hold a low-privileged account but needs no user interaction; there is no confidentiality or integrity impact and no code execution path, and no public exploit or CISA KEV listing was identified at time of analysis.
Partial denial of service in MySQL Server and MySQL Cluster can be triggered by a high-privileged, authenticated attacker with network access through MySQL protocols against the Server: Telemetry component. The affected releases are MySQL Server and MySQL Cluster 8.4.0-8.4.12, 9.7.0-9.7.3, and 26.7.0-26.7.1. CVSS 3.1 scores the issue 2.7 with only low availability impact, and no public exploit was identified at time of analysis.
Denial of service in Oracle MySQL Server and MySQL Cluster allows an authenticated low-privilege attacker to hang or repeatedly crash the database service over the network. The flaw affects the Server: Components Services component in MySQL Server 8.4.0-8.4.12, 9.7.0-9.7.3, and 26.7.0-26.7.1, plus MySQL Cluster 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3, and 26.7.0-26.7.1; it is rated CVSS 6.5 with availability-only impact. No public exploit was identified at time of analysis, and the main prerequisite is a valid low-privilege database account reachable over MySQL-supported protocols.
High-privileged network attackers can force hangs or repeatable crashes and read a limited subset of data in Oracle MySQL Server and MySQL Cluster versions 9.7.0 through 9.7.3 and 26.7.0 through 26.7.1. The issue is in the Server: Security: Encryption component and requires an existing high-privilege MySQL account, so anonymous or low-privileged remote users are not sufficient. Oracle assigned CVSS 3.1 base score 5.5, and no public exploit identified at time of analysis; the referenced Oracle Critical Patch Update advisory is the primary source.
Oracle MySQL Server and MySQL Cluster deployments that run the Group Replication plugin (Server: Group Replication Plugin) can be driven into a hang or a frequently repeatable crash by a high-privileged, network-reachable database account, producing a complete denial of service on the affected instance. The issue affects MySQL Server 8.4.0-8.4.12, 9.7.0-9.7.3 and 26.7.0-26.7.1, and MySQL Cluster 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and 26.7.0-26.7.1; standalone servers that do not enable Group Replication are outside the exploitable path. The CVSS 3.1 base score is 4.9 (MEDIUM) with availability-only impact, and no public exploit identified at time of analysis; because the vector requires PR:H, exploitation is limited to trusted or already-compromised privileged accounts. Fixes are referenced through Oracle's October 2026 Critical Patch Update advisory.
Unauthenticated network attackers can cause a hang or frequently repeatable crash of Oracle MySQL Server and MySQL Cluster and make limited unauthorized data changes through the Server: Pluggable Auth component. Affected releases are MySQL Server 8.4.0 through 8.4.12, 9.7.0 through 9.7.3, and 26.7.0 through 26.7.1, plus MySQL Cluster 8.0.0 through 8.0.49, 8.4.0 through 8.4.12, 9.7.0 through 9.7.3, and 26.7.0 through 26.7.1. Oracle rates exploitation as difficult (CVSS 6.5, AC:H), and no public exploit identified at time of analysis; risk is highest where MySQL network ports are exposed to untrusted networks.
Authenticated low-privileged users can cause a hang or repeatable crash (complete denial of service) in Oracle MySQL Server 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1 and MySQL Cluster 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1 by reaching the Server: Security: Encryption component over network protocols. Oracle rates exploitation as difficult (AC:H) and impact as availability-only (CVSS 3.1 base 5.3); no public exploit was identified at time of analysis.
Unauthenticated network attackers can hang or repeatedly crash MySQL Server and MySQL Cluster by targeting the Server: Security: Encryption component, producing a complete denial of service against the database service. The flaw carries CVSS 3.1 base score 5.9 (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H) and affects MySQL Server 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1 plus MySQL Cluster 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and 26.7.0-26.7.1. Oracle characterizes the issue as difficult to exploit because attack complexity is high, meaning the attacker must satisfy server-side conditions outside their direct control (specific state, timing or race behavior) rather than sending a single deterministic request; there is no public exploit identified at time of analysis and the issue is not in CISA KEV. Impact is strictly availability - no confidentiality or integrity loss - so exposure is materially reduced for instances not reachable from untrusted networks.
High-privilege MySQL accounts can crash InnoDB-backed MySQL Server and MySQL Cluster instances by sending crafted requests over supported network protocols, causing a hang or repeatable full denial of service. Affected builds include MySQL Server 8.4.0-8.4.12, 9.7.0-9.7.3, and 26.7.0-26.7.1, as well as MySQL Cluster 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3, and 26.7.0-26.7.1. The CVSS 3.1 score is 4.9 (AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H); no CISA KEV entry or public exploit code was supplied, and the high-privilege prerequisite limits practical exposure to insiders or already-compromised accounts.
Authenticated high-privileged users can crash or hang MySQL Server and MySQL Cluster 9.7.0-9.7.3 and 26.7.0-26.7.1 through malformed input handled by the Server: GIS component, causing a denial of service with no confidentiality or integrity impact. Exploitation requires network access and a privileged database account, so realistic risk is concentrated in trusted-insider or already-compromised-credential scenarios; no public exploit identified at time of analysis.
Denial of service in Oracle MySQL Server and MySQL Cluster 26.7.0-26.7.1 allows a low-privileged authenticated attacker with network access to hang or repeatedly crash the service through flaws in MySQL client programs. The CVSS 3.1 score is 5.3 (AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H), reflecting high attack complexity and availability-only impact. No public exploit was identified at time of analysis, and the narrow affected release branch limits exposure.
High-privileged database users can hang or repeatedly crash Oracle MySQL Server and MySQL Cluster by sending crafted requests over network-reachable protocols. The flaw affects MySQL Server 8.4.0-8.4.12, 9.7.0-9.7.3, and 26.7.0-26.7.1, plus MySQL Cluster 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3, and 26.7.0-26.7.1; exploitation requires high privileges and is rated difficult (AC:H), with impact limited to availability. No public exploit code or CISA KEV entry is identified at time of analysis, so priority is low except where untrusted or excessive high-privileged access exists.
Denial of service in Oracle MySQL Server and MySQL Cluster's RAPID (HeatWave analytics) component affects MySQL Server 9.7.0-9.7.3 and 26.7.0-26.7.1 and MySQL Cluster 9.7.0-9.7.3 and 26.7.0-26.7.1. A network-based attacker who already holds high database privileges can, under difficult-to-satisfy conditions, hang or repeatedly crash the server, causing complete availability loss while confidentiality and integrity remain unaffected. No public exploit code or active exploitation is identified in the provided intelligence, and the high privilege and high complexity prerequisites keep real-world priority low-to-moderate.
Denial of service in Oracle MySQL Server and MySQL Cluster 9.7.0-9.7.3 and 26.7.0-26.7.1 lets a high-privileged, network-positioned attacker trigger a hang or repeatable crash in the Server: Components Services component. The CVSS 3.1 score is 4.4 (AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H), reflecting availability-only impact and a demanding attack path that requires an existing high-privilege database account plus non-trivial timing or state conditions. No public exploit code or confirmed active exploitation was identified in the provided intelligence.
Denial of service in Oracle MySQL Server (8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1) and MySQL Cluster (8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1) allows a high-privileged, network-positioned attacker to hang or repeatedly crash the database service, but only on deployments running Group Replication, since the defect sits in the Server: Group Replication GCS component and standalone instances never reach the vulnerable code path. Oracle scores it CVSS 3.1 4.9 (AV:N/AC:L/PR:H/UI:N, availability-only), so the realistic threat is a privileged insider, a stolen administrative account, or a multi-tenant clustered environment rather than an anonymous internet attacker. No public exploit code or active exploitation was identified at time of analysis, keeping this a genuine but low-priority availability issue rather than an emergency.
High-privileged MySQL accounts can crash or hang the database engine through the Server: Clone Plugin component, giving a complete denial of service against MySQL Server and MySQL Cluster deployments. The flaw carries a CVSS 3.1 base score of 4.9 (AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H), meaning the attacker must already hold a high-privilege MySQL account and network reachability to the database, but once those preconditions are met the crash is low-complexity, requires no user interaction, and is easily repeatable. Affected builds are MySQL Server 8.4.0-8.4.12, 9.7.0-9.7.3 and 26.7.0-26.7.1, plus MySQL Cluster 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and 26.7.0-26.7.1; no public exploit identified at time of analysis. Realistic exposure is largely confined to insiders, compromised privileged accounts, or post-compromise lateral movement rather than anonymous internet attackers.
Denial of service in Oracle MySQL Server and MySQL Cluster 26.7.0-26.7.1 lets a high-privileged, network-positioned user trigger hangs or repeatable crashes in the Server: Security: Encryption component. The flaw is remotely reachable via multiple MySQL protocols with low attack complexity once the attacker already holds an administrative MySQL account, and it affects availability only (CVSS 3.1 4.9, A:H). No public exploit identified at time of analysis; the high-privilege prerequisite confines practical risk to trusted insiders or post-compromise scenarios.
Low-privileged database users with network access can repeatedly crash or hang MySQL Server and MySQL Cluster through the Security: Audit subsystem, producing a complete denial of service against the instance. The flaw carries a CVSS 3.1 score of 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) and affects MySQL Server 8.4.0-8.4.12, 9.7.0-9.7.3 and 26.7.0-26.7.1 plus MySQL Cluster 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and 26.7.0-26.7.1. Exploitation is not known to be active and no public exploit code has been identified at time of analysis, but the only real prerequisite is a valid low-privileged account - no user interaction or elevated rights - so exposure is greatest where shared or untrusted application accounts can reach the listener. This is a moderate-priority availability flaw, not a critical breach risk: confidentiality and integrity are unaffected.
Denial of service in Oracle MySQL Server and MySQL Cluster allows a low-privileged authenticated database user to hang or repeatedly crash the service via network-accessible InnoDB operations. Affected branches include MySQL Server 8.4.0-8.4.12, 9.7.0-9.7.3, and 26.7.0-26.7.1, plus MySQL Cluster 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3, and 26.7.0-26.7.1. The CVSS 3.1 score is 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H); no public exploit identified at time of analysis and no CISA KEV confirmation was present in the supplied intelligence.
Authenticated low-privileged users can crash or hang MySQL Server and MySQL Cluster 26.7.0 through 26.7.1 by sending crafted queries over the network that exercise the Server: GIS (spatial data) component, producing a complete denial of service. The flaw is rated CVSS 3.1 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), so only availability is affected and valid credentials are required. No public exploit code or confirmed active exploitation was identified at time of analysis, and Oracle's October 2026 Critical Patch Update advisory is the reference point for fixes.
Denial of service in Oracle MySQL Server and MySQL Cluster JSON processing allows a low-privileged authenticated attacker with network access to hang or repeatedly crash the database service (CVSS 3.1 score 6.5, availability-only). Affected releases include MySQL Server 8.4.0-8.4.12, 9.7.0-9.7.3, and 26.7.0-26.7.1, plus MySQL Cluster 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3, and 26.7.0-26.7.1. The CVSS vector confirms PR:L authentication is required, and no public exploit was identified at time of analysis; no CISA KEV status was supplied.
Denial of service in MySQL Server and MySQL Cluster lets an attacker who already holds high database privileges crash or repeatedly hang the service by sending crafted input that exercises the Server: Optimizer component. The affected releases are MySQL Server 8.4.0-8.4.12, 9.7.0-9.7.3, and 26.7.0-26.7.1, plus MySQL Cluster 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3, and 26.7.0-26.7.1; the CVSS vector confirms network reachability, low attack complexity, no user interaction, and an availability-only impact, but the PR:H prerequisite sharply limits who can exploit it. No public exploit identified at time of analysis, and no CISA KEV entry is present in the supplied data, so this is a moderate availability risk rather than a broad unauthenticated remote attack.
Denial of service in Oracle MySQL Server and MySQL Cluster lets a high-privileged, network-connected database user hang or repeatedly crash the server by exercising the Server: Optimizer component. Only MySQL Server 8.4.0 through 8.4.12, 9.7.0 through 9.7.3 and 26.7.0 through 26.7.1, plus MySQL Cluster 8.0.0 through 8.0.49 and the 8.4.x, 9.7.x and 26.7.x branches, are affected; the CVSS 3.1 score is 4.9 (AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H), reflecting an availability-only impact. The decisive constraint is the PR:H prerequisite - an unprivileged or read-only account cannot trigger it, so the realistic threat is an insider or an actor who already holds a privileged database credential; no public exploit code and no confirmed active exploitation were identified at time of analysis. Exploitation condition: authenticated session as a high-privileged MySQL user with network reachability to the listener over a supported protocol, submitting crafted input that reaches the optimizer; no user interaction is required and complexity is low, so the crash is reliably repeatable once that access exists.
Denial of service in MySQL Server and MySQL Cluster 9.7.0-9.7.1 allows a network-connected, high-privileged attacker to cause a complete hang or repeatable crash of the database server by targeting the Server: Optimizer component. Oracle classifies the vulnerability as 'easily exploitable' once credentials are obtained, though the high-privilege prerequisite (PR:H) substantially constrains real-world exposure. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis.
Denial of service in MySQL Server and MySQL Cluster 9.7.0-9.7.1 allows a high-privileged network-authenticated attacker to cause a complete, repeatably triggerable crash or hang of the database server via the Optimizer component. Disclosed in Oracle's Critical Patch Update for July 2026, the vulnerability carries a CVSS 3.1 score of 4.9 (Medium), with the moderate score driven entirely by the high privilege requirement (PR:H) that constrains the attack surface to users holding elevated database credentials. No public exploit code or confirmed active exploitation has been identified at time of analysis, and the vulnerability has not been added to the CISA KEV catalog.
Denial of service in Oracle MySQL Server and MySQL Cluster's JSON component allows a low-privileged, network-authenticated attacker to cause a complete hang or frequently repeatable crash of the database server. Affected releases span MySQL Server 8.4.0-8.4.10 and 9.7.0-9.7.1, as well as MySQL Cluster 8.0.0-8.0.47, 8.4.0-8.4.10, and 9.7.0-9.7.1. No public exploit identified at time of analysis, and the vulnerability is not currently listed in the CISA KEV catalog, though the low attack complexity and low privilege requirement make it straightforward to trigger once database credentials are obtained.
Denial-of-service in MySQL Server and MySQL Cluster 9.7.0-9.7.1 allows any low-privileged, network-authenticated attacker to cause a complete, repeatable crash or hang of the database server via the GIS (Geographic Information System) component. Oracle confirmed this in the July 2026 Critical Patch Update with a CVSS 3.1 score of 6.5. No public exploit code or active exploitation has been identified at time of analysis.
Local authentication bypass in MySQL Server and MySQL Cluster's Pluggable Auth component allows an unauthenticated local attacker to perform unauthorized data modification under high-complexity conditions. The flaw affects MySQL Server 8.4.0-8.4.10 and 9.7.0-9.7.1, as well as MySQL Cluster across 8.0.0-8.0.47, 8.4.0-8.4.10, and 9.7.0-9.7.1. Impact is limited to low-severity integrity compromise - no confidentiality or availability impact - with no public exploit or CISA KEV listing identified at time of analysis.
Denial-of-service in MySQL Server and MySQL Cluster 9.7.0-9.7.1 allows a low-privileged network attacker to repeatedly crash or hang the database server via a flaw in the Optimizer component. Oracle classifies this as 'easily exploitable' with network access required over multiple protocols, meaning any valid database account holder can trigger the condition without elevated permissions. No public exploit code or active exploitation has been identified at time of analysis.
Unauthorized data read in MySQL Server and MySQL Cluster's Performance Schema component exposes a subset of accessible data to highly privileged, network-connected attackers. Affected releases span MySQL Server 8.4.0-8.4.10 and 9.7.0-9.7.1, and MySQL Cluster 8.0.0-8.0.47, 8.4.0-8.4.10, and 9.7.0-9.7.1, disclosed as part of Oracle's July 2026 Critical Patch Update. No public exploit code and no CISA KEV listing are identified at time of analysis; the CVSS 2.7 score reflects the limited scope and elevated privilege bar.
Local denial-of-service in Oracle MySQL Server and MySQL Cluster allows an unauthenticated attacker with OS-level logon access to the host infrastructure to crash or hang the database service via a flaw in the Replication component. Affected versions span MySQL Server 8.4.0-8.4.10 and 9.7.0-9.7.1, and MySQL Cluster 8.0.0-8.0.47, 8.4.0-8.4.10, and 9.7.0-9.7.1. Oracle classifies this as easily exploitable; no public exploit code or CISA KEV listing has been identified at time of analysis, and exploitation requires physical or logical host-level access rather than remote network reachability.
Denial-of-service in MySQL Server and MySQL Cluster 9.7.0-9.7.1 allows a low-privileged, network-connected attacker to repeatedly hang or crash the database server by exploiting a flaw in the JSON component. The vulnerability requires only a valid MySQL login and network access over any supported protocol, making it trivially reachable in multi-tenant or cloud-hosted environments. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and low privilege threshold elevate practical risk above what the moderate CVSS score of 6.5 might suggest.
Full takeover of Oracle MySQL Server and MySQL Cluster is achievable through the Server: Replication component by a highly privileged network attacker who can satisfy difficult exploitation conditions. Affected deployments include MySQL Server 8.4.0-8.4.10 and 9.7.0-9.7.1, as well as MySQL Cluster 8.0.0-8.0.47, 8.4.0-8.4.10, and 9.7.0-9.7.1, with complete confidentiality, integrity, and availability impact upon successful exploitation. Oracle disclosed this through the July 2026 Critical Patch Update; no public exploit identified at time of analysis.
MySQL Cluster's NDB Operator component allows a local, unauthenticated attacker with logon access to the infrastructure host to bypass authentication controls and gain complete read access to all MySQL Cluster data. Three active release lines are affected - 8.0.0-8.0.47, 8.4.0-8.4.10, and 9.7.0-9.7.1 - as confirmed by Oracle's July 2026 Critical Patch Update. No public exploit has been identified at time of analysis, and the high attack complexity (AC:H) together with the local-only access vector (AV:L) substantially constrain realistic exploitation, though the data-exposure consequence remains significant for environments handling sensitive workloads.
Full takeover of Oracle MySQL Server and MySQL Cluster is achievable by a high-privileged local attacker exploiting a flaw in the Group Replication Group Communication System (GCS) component across multiple supported release trains. Affected deployments span MySQL Server 8.4.x and 9.7.x, and MySQL Cluster 8.0.x, 8.4.x, and 9.7.x. Despite the CVSS score of 6.4 being mid-range, the CIA impact triple (C:H/I:H/A:H) indicates complete compromise of the database instance; however, the local attack vector (AV:L), high complexity (AC:H), and high privilege requirement (PR:H) substantially constrain real-world exploitation. No public exploit code or CISA KEV listing has been identified at time of analysis.
Full takeover of MySQL Server and MySQL Cluster is possible through a difficult-to-exploit flaw in the Server: Replication component, affecting MySQL Server 8.4.0-8.4.10 and 9.7.0-9.7.1, and MySQL Cluster 8.0.0-8.0.47, 8.4.0-8.4.10, and 9.7.0-9.7.1. Despite a moderate CVSS base score of 6.4, the impact triad is complete (C:H/I:H/A:H), meaning successful exploitation grants an attacker full control over data confidentiality, integrity, and service availability. No public exploit code exists and no confirmed active exploitation has been identified at time of analysis, with exploitation gated by local infrastructure access and high privilege requirements.
Denial-of-service in MySQL Server and MySQL Cluster 9.7.0-9.7.1 allows any low-privileged, network-accessible attacker to crash or hang the database server by exploiting a flaw in the Optimizer component. The attack requires only valid database credentials and can be executed via multiple supported protocols (e.g., classic MySQL protocol, X Protocol), with no additional user interaction or elevated permissions. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, but Oracle's own language - 'easily exploitable' - and the CVSS AC:L rating indicate low barrier to triggering the condition once credentials are obtained.
MySQL Server and MySQL Cluster versions 9.0.0 through 9.7.1 are vulnerable to a network-reachable denial-of-service condition in the query Optimizer component, exploitable by any low-privileged authenticated user. A successful attack causes a complete, repeatable hang or crash of the database server process, disrupting all connected clients. No active exploitation has been confirmed (not listed in CISA KEV), and no public exploit code has been identified at time of analysis.
Denial of service in Oracle MySQL Server and MySQL Cluster 9.7.0-9.7.1 allows a high-privileged authenticated attacker to cause a complete, repeatable crash or hang of the database service by exploiting a flaw in the Server: JSON Duality component over any supported network protocol. The vulnerability is rated medium severity (CVSS 4.9) due to the high privilege prerequisite, limiting real-world exposure primarily to environments where privileged credentials have been compromised or where insider threat is a concern. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
Denial of service in MySQL Server and MySQL Cluster 9.7.0-9.7.1 allows a high-privileged network attacker to cause a complete hang or repeatable crash of the database server via the JSON Duality component. The vulnerability is rated CVSS 4.9, with the PR:H requirement substantially limiting real-world exposure to authenticated administrators or compromised high-privilege accounts. No public exploit code or active exploitation has been identified at time of analysis.
Denial-of-service exposure in MySQL Server and MySQL Cluster's Replication component allows a high-privileged local attacker to repeatedly crash or hang the database service under difficult-to-reproduce conditions. Affected are MySQL Server versions 8.4.0-8.4.10 and 9.7.0-9.7.1, and MySQL Cluster 8.0.0-8.0.47, 8.4.0-8.4.10, and 9.7.0-9.7.1. Oracle addressed this in the July 2026 Critical Patch Update; no public exploit code or active exploitation has been identified at time of analysis.
Partial denial-of-service in Oracle MySQL Server and MySQL Cluster's Replication component affects multiple supported release lines, exploitable only by highly privileged, authenticated attackers over the network under difficult conditions. The attack yields only a partial availability impact with no confidentiality or integrity exposure, and no public exploit code has been identified at time of analysis. Given the CVSS score of 2.2 and the combination of high complexity and high privilege requirements, this represents a low-priority, low-impact finding in the context of Oracle's July 2026 Critical Patch Update.
Denial of service in Oracle MySQL Server and MySQL Cluster's Replication component allows a high-privileged network attacker to cause a complete, repeatable crash or hang of the database service. Affected are MySQL Server 8.4.0-8.4.10 and 9.7.0-9.7.1, and MySQL Cluster 8.0.0-8.0.47, 8.4.0-8.4.10, and 9.7.0-9.7.1. No public exploit identified at time of analysis; the CVSS 3.1 score of 4.4 (Medium) accurately reflects the high privilege requirement and elevated attack complexity that substantially constrain real-world risk.
Denial of service in Oracle MySQL Server and MySQL Cluster's replication component allows a high-privileged network attacker to cause a complete hang or repeatedly crash the database server. Affected deployments span MySQL Server 8.4.0-8.4.10 and 9.7.0-9.7.1, as well as MySQL Cluster 8.0.0-8.0.47, 8.4.0-8.4.10, and 9.7.0-9.7.1. No public exploit code and no confirmed active exploitation have been identified; the high privilege and high complexity requirements substantially constrain real-world risk to insider threats or compromised DBA-level accounts.
Denial-of-service exposure in the MySQL Server and MySQL Cluster Replication component allows a high-privileged, network-connected attacker to crash or hang the database instance repeatedly. Affected releases span MySQL Server 8.4.0-8.4.10 and 9.7.0-9.7.1, and MySQL Cluster 8.0.0-8.0.47, 8.4.0-8.4.10, and 9.7.0-9.7.1, as confirmed by Oracle's July 2026 Critical Patch Update and ENISA EUVD-2026-46593. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog; however, its presence in a broadly deployed database product warrants patch prioritization within normal maintenance cycles for affected installations.
Denial-of-service in Oracle MySQL Server and MySQL Cluster's Group Replication Plugin allows a high-privileged, network-authenticated attacker to cause a complete hang or frequently repeatable crash of the database server. Affected deployments span MySQL Server 8.4.0-8.4.10 and 9.7.0-9.7.1, as well as MySQL Cluster 8.0.0-8.0.47, 8.4.0-8.4.10, and 9.7.0-9.7.1, as confirmed by Oracle's July 2026 Critical Patch Update. No public exploit code and no CISA KEV listing exist at time of analysis; the high attack complexity and high privilege requirement substantially limit real-world exploitation reach.
Denial-of-service in Oracle MySQL Server and MySQL Cluster's Replication component allows a high-privileged, network-connected attacker to cause a complete hang or frequently repeatable crash of the database server. Affected are MySQL Server 8.4.0-8.4.10 and 9.7.0-9.7.1, and MySQL Cluster 8.0.0-8.0.47, 8.4.0-8.4.10, and 9.7.0-9.7.1. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog; the combination of high attack complexity and high privilege requirements substantially limits realistic exploitation risk.
Denial-of-service in MySQL Server and MySQL Cluster's Replication component allows a high-privileged, network-based attacker to cause a repeatable server hang or crash under difficult-to-reproduce conditions. Affected deployments span MySQL Server 8.4.0-8.4.10 and 9.7.0-9.7.1, plus MySQL Cluster 8.0.0-8.0.47 and the same 8.4/9.7 ranges, with Oracle issuing a fix via the July 2026 Critical Patch Update. No public exploit has been identified and this CVE is not listed in CISA KEV, but the broad version coverage across active MySQL release trains warrants timely patching for environments running MySQL replication.
Full takeover of Oracle MySQL Server and MySQL Cluster is possible through a local, high-complexity vulnerability in the Clone Plugin component, affecting MySQL Server 8.4.0-8.4.10 and 9.7.0-9.7.1, and MySQL Cluster 8.0.0-8.0.47, 8.4.0-8.4.10, and 9.7.0-9.7.1. Exploitation requires an attacker with high privileges and local logon access to the host infrastructure where MySQL executes, under difficult-to-achieve conditions, limiting realistic risk despite the full confidentiality, integrity, and availability impact. No public exploit code and no CISA KEV listing have been identified at time of analysis, and Oracle disclosed this via the July 2026 Critical Patch Update.
Denial-of-service exploitation in Oracle MySQL Server and MySQL Cluster via the Clone Plugin allows a high-privileged, network-connected attacker to cause a complete hang or repeatedly repeatable crash of the database server. Affected version ranges span MySQL Server 8.4.0-8.4.10 and 9.7.0-9.7.1, and MySQL Cluster 8.0.0-8.0.47, 8.4.0-8.4.10, and 9.7.0-9.7.1, disclosed in Oracle's July 2026 Critical Patch Update. No public exploit or active exploitation has been identified; attack complexity is high and requires pre-existing high database privileges, significantly constraining real-world risk to insider or post-breach scenarios.
Full takeover of MySQL Server and MySQL Cluster 9.7.0-9.7.1 is achievable via a local, low-privileged attacker exploiting a flaw in the Server: Configurator component, provided a second user interacts during the attack window. The CVSS 3.1 score of 6.7 reflects the high attack complexity and local-only vector, which meaningfully constrain real-world exploitability despite the high-impact outcome (C:H/I:H/A:H). No public exploit code has been identified at time of analysis, and CISA KEV confirmation is absent.
Full takeover of MySQL Server and MySQL Cluster is possible through a difficult-to-exploit vulnerability in the Clone Plugin component, requiring a high-privileged attacker with network access via multiple protocols. Affected are MySQL Server versions 8.4.0-8.4.10 and 9.7.0-9.7.1, and MySQL Cluster versions 8.0.0-8.0.47, 8.4.0-8.4.10, and 9.7.0-9.7.1. No public exploit code or CISA KEV listing has been identified at time of analysis; risk is tempered by the AC:H/PR:H exploitation prerequisites, though the full CIA:H/H/H impact warrants priority patching in environments using the Clone Plugin.
Denial-of-service in Oracle MySQL Server and MySQL Cluster's Clone Plugin allows a high-privileged, network-connected attacker to crash or hang the database server through a difficult-to-exploit attack path. Affected are MySQL Server versions 8.4.0-8.4.10 and 9.7.0-9.7.1, and MySQL Cluster versions 8.0.0-8.0.47, 8.4.0-8.4.10, and 9.7.0-9.7.1. No public exploit identified at time of analysis, and Oracle disclosed this via its July 2026 Critical Patch Update; exploitation would result in complete availability loss for the targeted database instance.
Denial-of-service via the Optimizer component in MySQL Server and MySQL Cluster 9.7.0-9.7.1 allows a low-privileged, network-authenticated attacker to cause a complete, repeatable hang or crash of the database service. The flaw is network-reachable over multiple protocols and requires no user interaction, making it straightforward to trigger by any user holding even minimal database credentials. No public exploit code or active exploitation has been identified at time of analysis; Oracle disclosed this in the Critical Patch Update for July 2026.
Oracle MySQL Cluster's Server: Optimizer component in versions 8.0.0 through 8.0.47 can be exploited by a high-privileged remote attacker to cause a complete denial of service via repeated hang or crash of the cluster. Oracle disclosed and patched this in the July 2026 Critical Patch Update (CPU). No public exploit code or active exploitation has been identified at time of analysis, and CISA KEV listing is absent.
MySQL Server and MySQL Cluster's Optimizer component can be crashed or hung by a high-privileged attacker with network access, resulting in complete denial of service. Affected deployments span MySQL Server 8.4.0-8.4.10 and 9.7.0-9.7.1, as well as MySQL Cluster 8.0.0-8.0.47, 8.4.0-8.4.10, and 9.7.0-9.7.1, per Oracle's July 2026 Critical Patch Update. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog, making real-world exploitation contingent on access to high-privileged database credentials.
Denial of service in Oracle MySQL Server and MySQL Cluster allows any low-privileged authenticated attacker with network access to hang or repeatably crash the database service by exploiting a flaw in the Optimizer component. Affected deployments span MySQL Server 8.4.0-8.4.10 and 9.7.0-9.7.1, and MySQL Cluster 8.0.0-8.0.47, 8.4.0-8.4.10, and 9.7.0-9.7.1, per Oracle's July 2026 Critical Patch Update. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog; however, the low attack complexity and minimal privilege requirement make this a credible availability risk for any deployment with externally or internally accessible database accounts.
Denial-of-service vulnerability in Oracle MySQL Server and MySQL Cluster's InnoDB storage engine component allows high-privileged network-authenticated attackers to cause a complete, frequently repeatable crash or hang of the database server. Affected deployments span MySQL Server 8.4.x and 9.7.x, as well as MySQL Cluster 8.0.x through 9.7.x, making this a broad cross-version exposure within Oracle's primary database products. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; the high privilege requirement substantially narrows the real-world attacker population.
Denial of service in Oracle MySQL Server and MySQL Cluster's Replication component allows a high-privileged, network-connected attacker to cause repeated crashes or indefinite hangs across affected 8.0, 8.4, and 9.7 release branches. Exploitation is straightforward (AC:L) but gated entirely by the requirement for high database privileges, substantially narrowing the realistic threat population. No public exploit identified at time of analysis and no CISA KEV listing; risk is most acute in replication-dependent high-availability clusters where availability SLAs are critical.
Denial-of-service in Oracle MySQL Server and MySQL Cluster's Optimizer component allows a high-privileged, network-connected attacker to crash or hang the database server. Affected products span MySQL Server 8.4.0-8.4.10 and 9.7.0-9.7.1, as well as MySQL Cluster 8.0.0-8.0.47, 8.4.0-8.4.10, and 9.7.0-9.7.1, per Oracle's July 2026 Critical Patch Update. No public exploit code and no active exploitation (CISA KEV) have been identified at time of analysis; the high privilege and high complexity requirements materially constrain real-world risk.
Denial-of-service in Oracle MySQL Server and MySQL Cluster versions 9.7.0-9.7.1 allows a high-privileged, network-adjacent attacker to repeatedly hang or crash the InnoDB storage engine via multiple supported protocols. The CVSS 3.1 score of 4.9 reflects the PR:H prerequisite, which significantly limits the exploitable population to authenticated database administrators or equivalently privileged accounts. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Denial-of-service in Oracle MySQL Server and MySQL Cluster's DDL component allows a high-privileged, network-connected attacker to cause a complete server hang or repeatable crash under difficult-to-reproduce conditions. Affected product lines span MySQL Server 8.4.x and 9.7.x and MySQL Cluster 8.0.x through 9.7.x, as confirmed in Oracle's July 2026 Critical Patch Update (EUVD-2026-46462). No public exploit or confirmed active exploitation has been identified at time of analysis.
Mysql Cluster contains a vulnerability that allows attackers to unauthorized ability to cause a hang or frequently repeatable crash (complete DO (CVSS 4.9).
Vulnerability in the MySQL Client product of Oracle MySQL (component: Client: mysqldump). Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable. No vendor patch available.
Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: NDBCluster Plugin). Rated medium severity (CVSS 4.9), this vulnerability is remotely exploitable, low attack complexity.
Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Rated medium severity (CVSS 5.5), this vulnerability is remotely exploitable, low attack complexity.
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Replication). Rated low severity (CVSS 2.7), this vulnerability is remotely exploitable, low attack complexity. This Uncontrolled Resource Consumption vulnerability could allow attackers to cause denial of service by exhausting system resources.
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Parser). Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. This Uncontrolled Resource Consumption vulnerability could allow attackers to cause denial of service by exhausting system resources.
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Parser). Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. This Uncontrolled Resource Consumption vulnerability could allow attackers to cause denial of service by exhausting system resources.
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Packaging). Rated medium severity (CVSS 4.9), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Rated medium severity (CVSS 4.9), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Options). Rated low severity (CVSS 1.8). No vendor patch available.
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. This Uncontrolled Resource Consumption vulnerability could allow attackers to cause denial of service by exhausting system resources.
Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: Internal Operations). Rated medium severity (CVSS 6.3).
Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General). Rated medium severity (CVSS 6.3). No vendor patch available.
Due to the formatting logic of the "console.table()" function it was not safe to allow user controlled input to be passed to the "properties" parameter while simultaneously passing a plain object. Rated high severity (CVSS 8.2), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Full takeover of MySQL Server and MySQL Cluster is possible for unauthenticated attackers who can reach the Group Replication communication segment, affecting MySQL Server 8.4.0-8.4.12, 9.7.0-9.7.3 and 26.7.0-26.7.1 plus MySQL Cluster 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and 26.7.0-26.7.1. The flaw is in the Server: Group Replication GCS component and yields high confidentiality, integrity and availability impact (CVSS 8.8, AV:A/AC:L/PR:N/UI:N). Exploitation is limited to deployments running Group Replication and to attackers on the adjacent physical communication segment; no public exploit was identified at time of analysis and CISA KEV status is not indicated.
Unauthenticated remote attackers can corrupt or destroy data and trigger repeatable crashes of MySQL Server and MySQL Cluster through the Server: Replication component, affecting Server 8.4.0-8.4.12, 9.7.0-9.7.3 and 26.7.0-26.7.1 and Cluster 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and 26.7.0-26.7.1. Oracle rates it 7.4 (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H), explicitly calling it difficult to exploit, so success likely hinges on specific replication state, timing or race conditions rather than a single crafted request, and there is no confidentiality impact - the exposure is unauthorized creation, deletion or modification of critical data plus a hang or frequently repeatable full denial of service. No public exploit code or confirmed active exploitation was identified at time of analysis, and this is best treated as a genuine but second-tier priority concentrated on database nodes whose ports are network-reachable.
Unauthenticated attackers with access to the same layer-2 network segment as a MySQL Server or MySQL Cluster node running the Group Replication plugin can trigger a hang or frequently repeatable full crash (denial of service) and make limited unauthorized data changes, yielding a 7.1 CVSS score (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H). Exposure is narrow by design: the Group Replication plugin must be actively configured as part of a replication topology, which is not the default for standalone installations, and the attacker must sit on the adjacent broadcast domain or VLAN rather than reaching the host over the internet. No public exploit code has been identified at time of analysis, and the issue is not listed in CISA KEV; the practical risk is bounded far more by network adjacency and the non-default clustering configuration than by the raw score.
Unauthenticated, network-reachable attackers can potentially take over MySQL Server and MySQL Cluster through a high-complexity flaw in the 'Client programs' component, with full confidentiality, integrity, and availability impact. The issue affects MySQL Server 8.4.0-8.4.12, 9.7.0-9.7.3, and 26.7.0-26.7.1 plus MySQL Cluster 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3, and 26.7.0-26.7.1; Oracle rates it difficult to exploit (AC:H) and no public exploit identified at time of analysis.
Takeover of Oracle MySQL Server and MySQL Cluster can result when a client program connects to an attacker-controlled, rogue, or intercepted MySQL endpoint, exploiting a difficult-to-trigger flaw in the client programs component. Affected releases include MySQL Server 8.4.0-8.4.12, 9.7.0-9.7.3, and 26.7.0-26.7.1, plus MySQL Cluster 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3, and 26.7.0-26.7.1. Oracle rates it CVSS 8.1 with high confidentiality, integrity, and availability impact; the vector requires network access with no privileges, and high attack complexity reflects the need for server impersonation or interception, with no public exploit identified at time of analysis.
Oracle MySQL Server and MySQL Cluster client programs (MySQL Server 8.4.0-8.4.12, 9.7.0-9.7.3 and 26.7.0-26.7.1; MySQL Cluster 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and 26.7.0-26.7.1) harbor a high-complexity flaw that an unauthenticated network attacker can use to achieve full confidentiality, integrity and availability impact on a MySQL client, amounting to takeover in the assessed scope. Exploitation is constrained because the victim client must connect to an attacker-controlled or attacker-influenced server endpoint over one of the supported protocols, and Oracle rates the issue 'difficult to exploit' (AC:H). No public exploit was identified at time of analysis and no CISA KEV entry is present; CVSS 3.1 base score is 8.1.
Full takeover of Oracle MySQL Cluster is achievable by an unauthenticated remote attacker over HTTP across three active release trains: 8.0.0-8.0.48, 8.4.0-8.4.11, and 9.7.0-9.7.2. The attack carries high complexity and requires human interaction from a victim user, but successful exploitation yields complete confidentiality, integrity, and availability compromise of the cluster. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Remote unauthenticated denial-of-service and partial data integrity compromise in Oracle MySQL Cluster's NDB Operator component allows network attackers to crash or hang the cluster and perform unauthorized data modifications. Affected versions span three active release lines: 8.0.0-8.0.47, 8.4.0-8.4.10, and 9.7.0-9.7.1. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog, but the low attack complexity and zero authentication requirement make exploitation straightforward against exposed deployments.
Takeover of MySQL Server and MySQL Cluster is possible through the Server: Replication component, where a high-privileged attacker with network access can fully compromise affected instances. This authenticated flaw affects MySQL Server 8.4.0-8.4.10 and 9.7.0-9.7.1, and MySQL Cluster 8.0.0-8.0.47, 8.4.0-8.4.10 and 9.7.0-9.7.1, and is fixed in Oracle's July 2026 Critical Patch Update. Oracle rates it CVSS 7.2 with full confidentiality, integrity and availability impact; no public exploit identified at time of analysis.
Full takeover of Oracle MySQL Server and MySQL Cluster is possible through the Server: X Plugin component, allowing a high-privileged attacker with network access via multiple protocols to compromise confidentiality, integrity, and availability. Affected builds include MySQL Server 8.4.0-8.4.10 and 9.7.0-9.7.1, plus MySQL Cluster 8.0.0-8.0.47, 8.4.0-8.4.10 and 9.7.0-9.7.1. There is no public exploit identified at time of analysis and the flaw is not on the CISA KEV list, though Oracle rates it as easily exploitable once the required high privileges are held.
Remote unauthenticated denial-of-service and partial information disclosure affects Oracle MySQL Server 8.4.0-8.4.10 and 9.7.0-9.7.1 (and MySQL Cluster 8.0.0-8.0.47, 8.4.0-8.4.10, 9.7.0-9.7.1) through the Server: X Plugin component. An attacker with only network access, using multiple protocols, can trigger a hang or repeatable crash (complete DoS) and read a subset of accessible data, carrying an Oracle-assigned CVSS 3.1 score of 8.2. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Full takeover of Oracle MySQL Server and MySQL Cluster is possible through the Server: Group Replication Plugin, where a local attacker holding only a logon to the host running the database can compromise the instance without any database credentials. The flaw affects MySQL Server 8.4.0-8.4.10 and 9.7.0-9.7.1, plus MySQL Cluster 8.0.0-8.0.47, 8.4.0-8.4.10 and 9.7.0-9.7.1, and carries a CVSS 3.1 base score of 8.4 with high confidentiality, integrity and availability impact. No public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Remote unauthenticated denial-of-service in Oracle MySQL Server and MySQL Cluster (8.0.x, 8.4.x, and 9.0.0-9.7.0) allows network attackers to trigger a hang or repeatable crash of the database via the Server Connection Handling component. Oracle rates the issue as easily exploitable over multiple protocols with no authentication or user interaction, producing a complete availability loss (CVSS 7.5, A:H only). No public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Repeated-crash denial of service in Oracle MySQL Server (X Plugin component) and MySQL Cluster allows a low-privileged, network-positioned user to hang or fully take down the database service. Affected builds are MySQL Server 8.4.0-8.4.12, 9.7.0-9.7.3 and 26.7.0-26.7.1, plus MySQL Cluster 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and 26.7.0-26.7.1. Oracle rates it CVSS 3.1 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), meaning the attacker must already hold a low-privileged account but needs no user interaction; there is no confidentiality or integrity impact and no code execution path, and no public exploit or CISA KEV listing was identified at time of analysis.
Partial denial of service in MySQL Server and MySQL Cluster can be triggered by a high-privileged, authenticated attacker with network access through MySQL protocols against the Server: Telemetry component. The affected releases are MySQL Server and MySQL Cluster 8.4.0-8.4.12, 9.7.0-9.7.3, and 26.7.0-26.7.1. CVSS 3.1 scores the issue 2.7 with only low availability impact, and no public exploit was identified at time of analysis.
Denial of service in Oracle MySQL Server and MySQL Cluster allows an authenticated low-privilege attacker to hang or repeatedly crash the database service over the network. The flaw affects the Server: Components Services component in MySQL Server 8.4.0-8.4.12, 9.7.0-9.7.3, and 26.7.0-26.7.1, plus MySQL Cluster 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3, and 26.7.0-26.7.1; it is rated CVSS 6.5 with availability-only impact. No public exploit was identified at time of analysis, and the main prerequisite is a valid low-privilege database account reachable over MySQL-supported protocols.
High-privileged network attackers can force hangs or repeatable crashes and read a limited subset of data in Oracle MySQL Server and MySQL Cluster versions 9.7.0 through 9.7.3 and 26.7.0 through 26.7.1. The issue is in the Server: Security: Encryption component and requires an existing high-privilege MySQL account, so anonymous or low-privileged remote users are not sufficient. Oracle assigned CVSS 3.1 base score 5.5, and no public exploit identified at time of analysis; the referenced Oracle Critical Patch Update advisory is the primary source.
Oracle MySQL Server and MySQL Cluster deployments that run the Group Replication plugin (Server: Group Replication Plugin) can be driven into a hang or a frequently repeatable crash by a high-privileged, network-reachable database account, producing a complete denial of service on the affected instance. The issue affects MySQL Server 8.4.0-8.4.12, 9.7.0-9.7.3 and 26.7.0-26.7.1, and MySQL Cluster 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and 26.7.0-26.7.1; standalone servers that do not enable Group Replication are outside the exploitable path. The CVSS 3.1 base score is 4.9 (MEDIUM) with availability-only impact, and no public exploit identified at time of analysis; because the vector requires PR:H, exploitation is limited to trusted or already-compromised privileged accounts. Fixes are referenced through Oracle's October 2026 Critical Patch Update advisory.
Unauthenticated network attackers can cause a hang or frequently repeatable crash of Oracle MySQL Server and MySQL Cluster and make limited unauthorized data changes through the Server: Pluggable Auth component. Affected releases are MySQL Server 8.4.0 through 8.4.12, 9.7.0 through 9.7.3, and 26.7.0 through 26.7.1, plus MySQL Cluster 8.0.0 through 8.0.49, 8.4.0 through 8.4.12, 9.7.0 through 9.7.3, and 26.7.0 through 26.7.1. Oracle rates exploitation as difficult (CVSS 6.5, AC:H), and no public exploit identified at time of analysis; risk is highest where MySQL network ports are exposed to untrusted networks.
Authenticated low-privileged users can cause a hang or repeatable crash (complete denial of service) in Oracle MySQL Server 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1 and MySQL Cluster 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1 by reaching the Server: Security: Encryption component over network protocols. Oracle rates exploitation as difficult (AC:H) and impact as availability-only (CVSS 3.1 base 5.3); no public exploit was identified at time of analysis.
Unauthenticated network attackers can hang or repeatedly crash MySQL Server and MySQL Cluster by targeting the Server: Security: Encryption component, producing a complete denial of service against the database service. The flaw carries CVSS 3.1 base score 5.9 (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H) and affects MySQL Server 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1 plus MySQL Cluster 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and 26.7.0-26.7.1. Oracle characterizes the issue as difficult to exploit because attack complexity is high, meaning the attacker must satisfy server-side conditions outside their direct control (specific state, timing or race behavior) rather than sending a single deterministic request; there is no public exploit identified at time of analysis and the issue is not in CISA KEV. Impact is strictly availability - no confidentiality or integrity loss - so exposure is materially reduced for instances not reachable from untrusted networks.
High-privilege MySQL accounts can crash InnoDB-backed MySQL Server and MySQL Cluster instances by sending crafted requests over supported network protocols, causing a hang or repeatable full denial of service. Affected builds include MySQL Server 8.4.0-8.4.12, 9.7.0-9.7.3, and 26.7.0-26.7.1, as well as MySQL Cluster 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3, and 26.7.0-26.7.1. The CVSS 3.1 score is 4.9 (AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H); no CISA KEV entry or public exploit code was supplied, and the high-privilege prerequisite limits practical exposure to insiders or already-compromised accounts.
Authenticated high-privileged users can crash or hang MySQL Server and MySQL Cluster 9.7.0-9.7.3 and 26.7.0-26.7.1 through malformed input handled by the Server: GIS component, causing a denial of service with no confidentiality or integrity impact. Exploitation requires network access and a privileged database account, so realistic risk is concentrated in trusted-insider or already-compromised-credential scenarios; no public exploit identified at time of analysis.
Denial of service in Oracle MySQL Server and MySQL Cluster 26.7.0-26.7.1 allows a low-privileged authenticated attacker with network access to hang or repeatedly crash the service through flaws in MySQL client programs. The CVSS 3.1 score is 5.3 (AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H), reflecting high attack complexity and availability-only impact. No public exploit was identified at time of analysis, and the narrow affected release branch limits exposure.
High-privileged database users can hang or repeatedly crash Oracle MySQL Server and MySQL Cluster by sending crafted requests over network-reachable protocols. The flaw affects MySQL Server 8.4.0-8.4.12, 9.7.0-9.7.3, and 26.7.0-26.7.1, plus MySQL Cluster 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3, and 26.7.0-26.7.1; exploitation requires high privileges and is rated difficult (AC:H), with impact limited to availability. No public exploit code or CISA KEV entry is identified at time of analysis, so priority is low except where untrusted or excessive high-privileged access exists.
Denial of service in Oracle MySQL Server and MySQL Cluster's RAPID (HeatWave analytics) component affects MySQL Server 9.7.0-9.7.3 and 26.7.0-26.7.1 and MySQL Cluster 9.7.0-9.7.3 and 26.7.0-26.7.1. A network-based attacker who already holds high database privileges can, under difficult-to-satisfy conditions, hang or repeatedly crash the server, causing complete availability loss while confidentiality and integrity remain unaffected. No public exploit code or active exploitation is identified in the provided intelligence, and the high privilege and high complexity prerequisites keep real-world priority low-to-moderate.
Denial of service in Oracle MySQL Server and MySQL Cluster 9.7.0-9.7.3 and 26.7.0-26.7.1 lets a high-privileged, network-positioned attacker trigger a hang or repeatable crash in the Server: Components Services component. The CVSS 3.1 score is 4.4 (AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H), reflecting availability-only impact and a demanding attack path that requires an existing high-privilege database account plus non-trivial timing or state conditions. No public exploit code or confirmed active exploitation was identified in the provided intelligence.
Denial of service in Oracle MySQL Server (8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1) and MySQL Cluster (8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1) allows a high-privileged, network-positioned attacker to hang or repeatedly crash the database service, but only on deployments running Group Replication, since the defect sits in the Server: Group Replication GCS component and standalone instances never reach the vulnerable code path. Oracle scores it CVSS 3.1 4.9 (AV:N/AC:L/PR:H/UI:N, availability-only), so the realistic threat is a privileged insider, a stolen administrative account, or a multi-tenant clustered environment rather than an anonymous internet attacker. No public exploit code or active exploitation was identified at time of analysis, keeping this a genuine but low-priority availability issue rather than an emergency.
High-privileged MySQL accounts can crash or hang the database engine through the Server: Clone Plugin component, giving a complete denial of service against MySQL Server and MySQL Cluster deployments. The flaw carries a CVSS 3.1 base score of 4.9 (AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H), meaning the attacker must already hold a high-privilege MySQL account and network reachability to the database, but once those preconditions are met the crash is low-complexity, requires no user interaction, and is easily repeatable. Affected builds are MySQL Server 8.4.0-8.4.12, 9.7.0-9.7.3 and 26.7.0-26.7.1, plus MySQL Cluster 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and 26.7.0-26.7.1; no public exploit identified at time of analysis. Realistic exposure is largely confined to insiders, compromised privileged accounts, or post-compromise lateral movement rather than anonymous internet attackers.
Denial of service in Oracle MySQL Server and MySQL Cluster 26.7.0-26.7.1 lets a high-privileged, network-positioned user trigger hangs or repeatable crashes in the Server: Security: Encryption component. The flaw is remotely reachable via multiple MySQL protocols with low attack complexity once the attacker already holds an administrative MySQL account, and it affects availability only (CVSS 3.1 4.9, A:H). No public exploit identified at time of analysis; the high-privilege prerequisite confines practical risk to trusted insiders or post-compromise scenarios.
Low-privileged database users with network access can repeatedly crash or hang MySQL Server and MySQL Cluster through the Security: Audit subsystem, producing a complete denial of service against the instance. The flaw carries a CVSS 3.1 score of 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) and affects MySQL Server 8.4.0-8.4.12, 9.7.0-9.7.3 and 26.7.0-26.7.1 plus MySQL Cluster 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and 26.7.0-26.7.1. Exploitation is not known to be active and no public exploit code has been identified at time of analysis, but the only real prerequisite is a valid low-privileged account - no user interaction or elevated rights - so exposure is greatest where shared or untrusted application accounts can reach the listener. This is a moderate-priority availability flaw, not a critical breach risk: confidentiality and integrity are unaffected.
Denial of service in Oracle MySQL Server and MySQL Cluster allows a low-privileged authenticated database user to hang or repeatedly crash the service via network-accessible InnoDB operations. Affected branches include MySQL Server 8.4.0-8.4.12, 9.7.0-9.7.3, and 26.7.0-26.7.1, plus MySQL Cluster 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3, and 26.7.0-26.7.1. The CVSS 3.1 score is 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H); no public exploit identified at time of analysis and no CISA KEV confirmation was present in the supplied intelligence.
Authenticated low-privileged users can crash or hang MySQL Server and MySQL Cluster 26.7.0 through 26.7.1 by sending crafted queries over the network that exercise the Server: GIS (spatial data) component, producing a complete denial of service. The flaw is rated CVSS 3.1 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), so only availability is affected and valid credentials are required. No public exploit code or confirmed active exploitation was identified at time of analysis, and Oracle's October 2026 Critical Patch Update advisory is the reference point for fixes.
Denial of service in Oracle MySQL Server and MySQL Cluster JSON processing allows a low-privileged authenticated attacker with network access to hang or repeatedly crash the database service (CVSS 3.1 score 6.5, availability-only). Affected releases include MySQL Server 8.4.0-8.4.12, 9.7.0-9.7.3, and 26.7.0-26.7.1, plus MySQL Cluster 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3, and 26.7.0-26.7.1. The CVSS vector confirms PR:L authentication is required, and no public exploit was identified at time of analysis; no CISA KEV status was supplied.
Denial of service in MySQL Server and MySQL Cluster lets an attacker who already holds high database privileges crash or repeatedly hang the service by sending crafted input that exercises the Server: Optimizer component. The affected releases are MySQL Server 8.4.0-8.4.12, 9.7.0-9.7.3, and 26.7.0-26.7.1, plus MySQL Cluster 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3, and 26.7.0-26.7.1; the CVSS vector confirms network reachability, low attack complexity, no user interaction, and an availability-only impact, but the PR:H prerequisite sharply limits who can exploit it. No public exploit identified at time of analysis, and no CISA KEV entry is present in the supplied data, so this is a moderate availability risk rather than a broad unauthenticated remote attack.
Denial of service in Oracle MySQL Server and MySQL Cluster lets a high-privileged, network-connected database user hang or repeatedly crash the server by exercising the Server: Optimizer component. Only MySQL Server 8.4.0 through 8.4.12, 9.7.0 through 9.7.3 and 26.7.0 through 26.7.1, plus MySQL Cluster 8.0.0 through 8.0.49 and the 8.4.x, 9.7.x and 26.7.x branches, are affected; the CVSS 3.1 score is 4.9 (AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H), reflecting an availability-only impact. The decisive constraint is the PR:H prerequisite - an unprivileged or read-only account cannot trigger it, so the realistic threat is an insider or an actor who already holds a privileged database credential; no public exploit code and no confirmed active exploitation were identified at time of analysis. Exploitation condition: authenticated session as a high-privileged MySQL user with network reachability to the listener over a supported protocol, submitting crafted input that reaches the optimizer; no user interaction is required and complexity is low, so the crash is reliably repeatable once that access exists.
Denial of service in MySQL Server and MySQL Cluster 9.7.0-9.7.1 allows a network-connected, high-privileged attacker to cause a complete hang or repeatable crash of the database server by targeting the Server: Optimizer component. Oracle classifies the vulnerability as 'easily exploitable' once credentials are obtained, though the high-privilege prerequisite (PR:H) substantially constrains real-world exposure. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis.
Denial of service in MySQL Server and MySQL Cluster 9.7.0-9.7.1 allows a high-privileged network-authenticated attacker to cause a complete, repeatably triggerable crash or hang of the database server via the Optimizer component. Disclosed in Oracle's Critical Patch Update for July 2026, the vulnerability carries a CVSS 3.1 score of 4.9 (Medium), with the moderate score driven entirely by the high privilege requirement (PR:H) that constrains the attack surface to users holding elevated database credentials. No public exploit code or confirmed active exploitation has been identified at time of analysis, and the vulnerability has not been added to the CISA KEV catalog.
Denial of service in Oracle MySQL Server and MySQL Cluster's JSON component allows a low-privileged, network-authenticated attacker to cause a complete hang or frequently repeatable crash of the database server. Affected releases span MySQL Server 8.4.0-8.4.10 and 9.7.0-9.7.1, as well as MySQL Cluster 8.0.0-8.0.47, 8.4.0-8.4.10, and 9.7.0-9.7.1. No public exploit identified at time of analysis, and the vulnerability is not currently listed in the CISA KEV catalog, though the low attack complexity and low privilege requirement make it straightforward to trigger once database credentials are obtained.
Denial-of-service in MySQL Server and MySQL Cluster 9.7.0-9.7.1 allows any low-privileged, network-authenticated attacker to cause a complete, repeatable crash or hang of the database server via the GIS (Geographic Information System) component. Oracle confirmed this in the July 2026 Critical Patch Update with a CVSS 3.1 score of 6.5. No public exploit code or active exploitation has been identified at time of analysis.
Local authentication bypass in MySQL Server and MySQL Cluster's Pluggable Auth component allows an unauthenticated local attacker to perform unauthorized data modification under high-complexity conditions. The flaw affects MySQL Server 8.4.0-8.4.10 and 9.7.0-9.7.1, as well as MySQL Cluster across 8.0.0-8.0.47, 8.4.0-8.4.10, and 9.7.0-9.7.1. Impact is limited to low-severity integrity compromise - no confidentiality or availability impact - with no public exploit or CISA KEV listing identified at time of analysis.
Denial-of-service in MySQL Server and MySQL Cluster 9.7.0-9.7.1 allows a low-privileged network attacker to repeatedly crash or hang the database server via a flaw in the Optimizer component. Oracle classifies this as 'easily exploitable' with network access required over multiple protocols, meaning any valid database account holder can trigger the condition without elevated permissions. No public exploit code or active exploitation has been identified at time of analysis.
Unauthorized data read in MySQL Server and MySQL Cluster's Performance Schema component exposes a subset of accessible data to highly privileged, network-connected attackers. Affected releases span MySQL Server 8.4.0-8.4.10 and 9.7.0-9.7.1, and MySQL Cluster 8.0.0-8.0.47, 8.4.0-8.4.10, and 9.7.0-9.7.1, disclosed as part of Oracle's July 2026 Critical Patch Update. No public exploit code and no CISA KEV listing are identified at time of analysis; the CVSS 2.7 score reflects the limited scope and elevated privilege bar.
Local denial-of-service in Oracle MySQL Server and MySQL Cluster allows an unauthenticated attacker with OS-level logon access to the host infrastructure to crash or hang the database service via a flaw in the Replication component. Affected versions span MySQL Server 8.4.0-8.4.10 and 9.7.0-9.7.1, and MySQL Cluster 8.0.0-8.0.47, 8.4.0-8.4.10, and 9.7.0-9.7.1. Oracle classifies this as easily exploitable; no public exploit code or CISA KEV listing has been identified at time of analysis, and exploitation requires physical or logical host-level access rather than remote network reachability.
Denial-of-service in MySQL Server and MySQL Cluster 9.7.0-9.7.1 allows a low-privileged, network-connected attacker to repeatedly hang or crash the database server by exploiting a flaw in the JSON component. The vulnerability requires only a valid MySQL login and network access over any supported protocol, making it trivially reachable in multi-tenant or cloud-hosted environments. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and low privilege threshold elevate practical risk above what the moderate CVSS score of 6.5 might suggest.
Full takeover of Oracle MySQL Server and MySQL Cluster is achievable through the Server: Replication component by a highly privileged network attacker who can satisfy difficult exploitation conditions. Affected deployments include MySQL Server 8.4.0-8.4.10 and 9.7.0-9.7.1, as well as MySQL Cluster 8.0.0-8.0.47, 8.4.0-8.4.10, and 9.7.0-9.7.1, with complete confidentiality, integrity, and availability impact upon successful exploitation. Oracle disclosed this through the July 2026 Critical Patch Update; no public exploit identified at time of analysis.
MySQL Cluster's NDB Operator component allows a local, unauthenticated attacker with logon access to the infrastructure host to bypass authentication controls and gain complete read access to all MySQL Cluster data. Three active release lines are affected - 8.0.0-8.0.47, 8.4.0-8.4.10, and 9.7.0-9.7.1 - as confirmed by Oracle's July 2026 Critical Patch Update. No public exploit has been identified at time of analysis, and the high attack complexity (AC:H) together with the local-only access vector (AV:L) substantially constrain realistic exploitation, though the data-exposure consequence remains significant for environments handling sensitive workloads.
Full takeover of Oracle MySQL Server and MySQL Cluster is achievable by a high-privileged local attacker exploiting a flaw in the Group Replication Group Communication System (GCS) component across multiple supported release trains. Affected deployments span MySQL Server 8.4.x and 9.7.x, and MySQL Cluster 8.0.x, 8.4.x, and 9.7.x. Despite the CVSS score of 6.4 being mid-range, the CIA impact triple (C:H/I:H/A:H) indicates complete compromise of the database instance; however, the local attack vector (AV:L), high complexity (AC:H), and high privilege requirement (PR:H) substantially constrain real-world exploitation. No public exploit code or CISA KEV listing has been identified at time of analysis.
Full takeover of MySQL Server and MySQL Cluster is possible through a difficult-to-exploit flaw in the Server: Replication component, affecting MySQL Server 8.4.0-8.4.10 and 9.7.0-9.7.1, and MySQL Cluster 8.0.0-8.0.47, 8.4.0-8.4.10, and 9.7.0-9.7.1. Despite a moderate CVSS base score of 6.4, the impact triad is complete (C:H/I:H/A:H), meaning successful exploitation grants an attacker full control over data confidentiality, integrity, and service availability. No public exploit code exists and no confirmed active exploitation has been identified at time of analysis, with exploitation gated by local infrastructure access and high privilege requirements.
Denial-of-service in MySQL Server and MySQL Cluster 9.7.0-9.7.1 allows any low-privileged, network-accessible attacker to crash or hang the database server by exploiting a flaw in the Optimizer component. The attack requires only valid database credentials and can be executed via multiple supported protocols (e.g., classic MySQL protocol, X Protocol), with no additional user interaction or elevated permissions. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, but Oracle's own language - 'easily exploitable' - and the CVSS AC:L rating indicate low barrier to triggering the condition once credentials are obtained.
MySQL Server and MySQL Cluster versions 9.0.0 through 9.7.1 are vulnerable to a network-reachable denial-of-service condition in the query Optimizer component, exploitable by any low-privileged authenticated user. A successful attack causes a complete, repeatable hang or crash of the database server process, disrupting all connected clients. No active exploitation has been confirmed (not listed in CISA KEV), and no public exploit code has been identified at time of analysis.
Denial of service in Oracle MySQL Server and MySQL Cluster 9.7.0-9.7.1 allows a high-privileged authenticated attacker to cause a complete, repeatable crash or hang of the database service by exploiting a flaw in the Server: JSON Duality component over any supported network protocol. The vulnerability is rated medium severity (CVSS 4.9) due to the high privilege prerequisite, limiting real-world exposure primarily to environments where privileged credentials have been compromised or where insider threat is a concern. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
Denial of service in MySQL Server and MySQL Cluster 9.7.0-9.7.1 allows a high-privileged network attacker to cause a complete hang or repeatable crash of the database server via the JSON Duality component. The vulnerability is rated CVSS 4.9, with the PR:H requirement substantially limiting real-world exposure to authenticated administrators or compromised high-privilege accounts. No public exploit code or active exploitation has been identified at time of analysis.
Denial-of-service exposure in MySQL Server and MySQL Cluster's Replication component allows a high-privileged local attacker to repeatedly crash or hang the database service under difficult-to-reproduce conditions. Affected are MySQL Server versions 8.4.0-8.4.10 and 9.7.0-9.7.1, and MySQL Cluster 8.0.0-8.0.47, 8.4.0-8.4.10, and 9.7.0-9.7.1. Oracle addressed this in the July 2026 Critical Patch Update; no public exploit code or active exploitation has been identified at time of analysis.
Partial denial-of-service in Oracle MySQL Server and MySQL Cluster's Replication component affects multiple supported release lines, exploitable only by highly privileged, authenticated attackers over the network under difficult conditions. The attack yields only a partial availability impact with no confidentiality or integrity exposure, and no public exploit code has been identified at time of analysis. Given the CVSS score of 2.2 and the combination of high complexity and high privilege requirements, this represents a low-priority, low-impact finding in the context of Oracle's July 2026 Critical Patch Update.
Denial of service in Oracle MySQL Server and MySQL Cluster's Replication component allows a high-privileged network attacker to cause a complete, repeatable crash or hang of the database service. Affected are MySQL Server 8.4.0-8.4.10 and 9.7.0-9.7.1, and MySQL Cluster 8.0.0-8.0.47, 8.4.0-8.4.10, and 9.7.0-9.7.1. No public exploit identified at time of analysis; the CVSS 3.1 score of 4.4 (Medium) accurately reflects the high privilege requirement and elevated attack complexity that substantially constrain real-world risk.
Denial of service in Oracle MySQL Server and MySQL Cluster's replication component allows a high-privileged network attacker to cause a complete hang or repeatedly crash the database server. Affected deployments span MySQL Server 8.4.0-8.4.10 and 9.7.0-9.7.1, as well as MySQL Cluster 8.0.0-8.0.47, 8.4.0-8.4.10, and 9.7.0-9.7.1. No public exploit code and no confirmed active exploitation have been identified; the high privilege and high complexity requirements substantially constrain real-world risk to insider threats or compromised DBA-level accounts.
Denial-of-service exposure in the MySQL Server and MySQL Cluster Replication component allows a high-privileged, network-connected attacker to crash or hang the database instance repeatedly. Affected releases span MySQL Server 8.4.0-8.4.10 and 9.7.0-9.7.1, and MySQL Cluster 8.0.0-8.0.47, 8.4.0-8.4.10, and 9.7.0-9.7.1, as confirmed by Oracle's July 2026 Critical Patch Update and ENISA EUVD-2026-46593. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog; however, its presence in a broadly deployed database product warrants patch prioritization within normal maintenance cycles for affected installations.
Denial-of-service in Oracle MySQL Server and MySQL Cluster's Group Replication Plugin allows a high-privileged, network-authenticated attacker to cause a complete hang or frequently repeatable crash of the database server. Affected deployments span MySQL Server 8.4.0-8.4.10 and 9.7.0-9.7.1, as well as MySQL Cluster 8.0.0-8.0.47, 8.4.0-8.4.10, and 9.7.0-9.7.1, as confirmed by Oracle's July 2026 Critical Patch Update. No public exploit code and no CISA KEV listing exist at time of analysis; the high attack complexity and high privilege requirement substantially limit real-world exploitation reach.
Denial-of-service in Oracle MySQL Server and MySQL Cluster's Replication component allows a high-privileged, network-connected attacker to cause a complete hang or frequently repeatable crash of the database server. Affected are MySQL Server 8.4.0-8.4.10 and 9.7.0-9.7.1, and MySQL Cluster 8.0.0-8.0.47, 8.4.0-8.4.10, and 9.7.0-9.7.1. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog; the combination of high attack complexity and high privilege requirements substantially limits realistic exploitation risk.
Denial-of-service in MySQL Server and MySQL Cluster's Replication component allows a high-privileged, network-based attacker to cause a repeatable server hang or crash under difficult-to-reproduce conditions. Affected deployments span MySQL Server 8.4.0-8.4.10 and 9.7.0-9.7.1, plus MySQL Cluster 8.0.0-8.0.47 and the same 8.4/9.7 ranges, with Oracle issuing a fix via the July 2026 Critical Patch Update. No public exploit has been identified and this CVE is not listed in CISA KEV, but the broad version coverage across active MySQL release trains warrants timely patching for environments running MySQL replication.
Full takeover of Oracle MySQL Server and MySQL Cluster is possible through a local, high-complexity vulnerability in the Clone Plugin component, affecting MySQL Server 8.4.0-8.4.10 and 9.7.0-9.7.1, and MySQL Cluster 8.0.0-8.0.47, 8.4.0-8.4.10, and 9.7.0-9.7.1. Exploitation requires an attacker with high privileges and local logon access to the host infrastructure where MySQL executes, under difficult-to-achieve conditions, limiting realistic risk despite the full confidentiality, integrity, and availability impact. No public exploit code and no CISA KEV listing have been identified at time of analysis, and Oracle disclosed this via the July 2026 Critical Patch Update.
Denial-of-service exploitation in Oracle MySQL Server and MySQL Cluster via the Clone Plugin allows a high-privileged, network-connected attacker to cause a complete hang or repeatedly repeatable crash of the database server. Affected version ranges span MySQL Server 8.4.0-8.4.10 and 9.7.0-9.7.1, and MySQL Cluster 8.0.0-8.0.47, 8.4.0-8.4.10, and 9.7.0-9.7.1, disclosed in Oracle's July 2026 Critical Patch Update. No public exploit or active exploitation has been identified; attack complexity is high and requires pre-existing high database privileges, significantly constraining real-world risk to insider or post-breach scenarios.
Full takeover of MySQL Server and MySQL Cluster 9.7.0-9.7.1 is achievable via a local, low-privileged attacker exploiting a flaw in the Server: Configurator component, provided a second user interacts during the attack window. The CVSS 3.1 score of 6.7 reflects the high attack complexity and local-only vector, which meaningfully constrain real-world exploitability despite the high-impact outcome (C:H/I:H/A:H). No public exploit code has been identified at time of analysis, and CISA KEV confirmation is absent.
Full takeover of MySQL Server and MySQL Cluster is possible through a difficult-to-exploit vulnerability in the Clone Plugin component, requiring a high-privileged attacker with network access via multiple protocols. Affected are MySQL Server versions 8.4.0-8.4.10 and 9.7.0-9.7.1, and MySQL Cluster versions 8.0.0-8.0.47, 8.4.0-8.4.10, and 9.7.0-9.7.1. No public exploit code or CISA KEV listing has been identified at time of analysis; risk is tempered by the AC:H/PR:H exploitation prerequisites, though the full CIA:H/H/H impact warrants priority patching in environments using the Clone Plugin.
Denial-of-service in Oracle MySQL Server and MySQL Cluster's Clone Plugin allows a high-privileged, network-connected attacker to crash or hang the database server through a difficult-to-exploit attack path. Affected are MySQL Server versions 8.4.0-8.4.10 and 9.7.0-9.7.1, and MySQL Cluster versions 8.0.0-8.0.47, 8.4.0-8.4.10, and 9.7.0-9.7.1. No public exploit identified at time of analysis, and Oracle disclosed this via its July 2026 Critical Patch Update; exploitation would result in complete availability loss for the targeted database instance.
Denial-of-service via the Optimizer component in MySQL Server and MySQL Cluster 9.7.0-9.7.1 allows a low-privileged, network-authenticated attacker to cause a complete, repeatable hang or crash of the database service. The flaw is network-reachable over multiple protocols and requires no user interaction, making it straightforward to trigger by any user holding even minimal database credentials. No public exploit code or active exploitation has been identified at time of analysis; Oracle disclosed this in the Critical Patch Update for July 2026.
Oracle MySQL Cluster's Server: Optimizer component in versions 8.0.0 through 8.0.47 can be exploited by a high-privileged remote attacker to cause a complete denial of service via repeated hang or crash of the cluster. Oracle disclosed and patched this in the July 2026 Critical Patch Update (CPU). No public exploit code or active exploitation has been identified at time of analysis, and CISA KEV listing is absent.
MySQL Server and MySQL Cluster's Optimizer component can be crashed or hung by a high-privileged attacker with network access, resulting in complete denial of service. Affected deployments span MySQL Server 8.4.0-8.4.10 and 9.7.0-9.7.1, as well as MySQL Cluster 8.0.0-8.0.47, 8.4.0-8.4.10, and 9.7.0-9.7.1, per Oracle's July 2026 Critical Patch Update. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog, making real-world exploitation contingent on access to high-privileged database credentials.
Denial of service in Oracle MySQL Server and MySQL Cluster allows any low-privileged authenticated attacker with network access to hang or repeatably crash the database service by exploiting a flaw in the Optimizer component. Affected deployments span MySQL Server 8.4.0-8.4.10 and 9.7.0-9.7.1, and MySQL Cluster 8.0.0-8.0.47, 8.4.0-8.4.10, and 9.7.0-9.7.1, per Oracle's July 2026 Critical Patch Update. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog; however, the low attack complexity and minimal privilege requirement make this a credible availability risk for any deployment with externally or internally accessible database accounts.
Denial-of-service vulnerability in Oracle MySQL Server and MySQL Cluster's InnoDB storage engine component allows high-privileged network-authenticated attackers to cause a complete, frequently repeatable crash or hang of the database server. Affected deployments span MySQL Server 8.4.x and 9.7.x, as well as MySQL Cluster 8.0.x through 9.7.x, making this a broad cross-version exposure within Oracle's primary database products. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; the high privilege requirement substantially narrows the real-world attacker population.
Denial of service in Oracle MySQL Server and MySQL Cluster's Replication component allows a high-privileged, network-connected attacker to cause repeated crashes or indefinite hangs across affected 8.0, 8.4, and 9.7 release branches. Exploitation is straightforward (AC:L) but gated entirely by the requirement for high database privileges, substantially narrowing the realistic threat population. No public exploit identified at time of analysis and no CISA KEV listing; risk is most acute in replication-dependent high-availability clusters where availability SLAs are critical.
Denial-of-service in Oracle MySQL Server and MySQL Cluster's Optimizer component allows a high-privileged, network-connected attacker to crash or hang the database server. Affected products span MySQL Server 8.4.0-8.4.10 and 9.7.0-9.7.1, as well as MySQL Cluster 8.0.0-8.0.47, 8.4.0-8.4.10, and 9.7.0-9.7.1, per Oracle's July 2026 Critical Patch Update. No public exploit code and no active exploitation (CISA KEV) have been identified at time of analysis; the high privilege and high complexity requirements materially constrain real-world risk.
Denial-of-service in Oracle MySQL Server and MySQL Cluster versions 9.7.0-9.7.1 allows a high-privileged, network-adjacent attacker to repeatedly hang or crash the InnoDB storage engine via multiple supported protocols. The CVSS 3.1 score of 4.9 reflects the PR:H prerequisite, which significantly limits the exploitable population to authenticated database administrators or equivalently privileged accounts. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Denial-of-service in Oracle MySQL Server and MySQL Cluster's DDL component allows a high-privileged, network-connected attacker to cause a complete server hang or repeatable crash under difficult-to-reproduce conditions. Affected product lines span MySQL Server 8.4.x and 9.7.x and MySQL Cluster 8.0.x through 9.7.x, as confirmed in Oracle's July 2026 Critical Patch Update (EUVD-2026-46462). No public exploit or confirmed active exploitation has been identified at time of analysis.
Mysql Cluster contains a vulnerability that allows attackers to unauthorized ability to cause a hang or frequently repeatable crash (complete DO (CVSS 4.9).
Vulnerability in the MySQL Client product of Oracle MySQL (component: Client: mysqldump). Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable. No vendor patch available.
Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: NDBCluster Plugin). Rated medium severity (CVSS 4.9), this vulnerability is remotely exploitable, low attack complexity.
Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Rated medium severity (CVSS 5.5), this vulnerability is remotely exploitable, low attack complexity.
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Replication). Rated low severity (CVSS 2.7), this vulnerability is remotely exploitable, low attack complexity. This Uncontrolled Resource Consumption vulnerability could allow attackers to cause denial of service by exhausting system resources.
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Parser). Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. This Uncontrolled Resource Consumption vulnerability could allow attackers to cause denial of service by exhausting system resources.
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Parser). Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. This Uncontrolled Resource Consumption vulnerability could allow attackers to cause denial of service by exhausting system resources.
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Packaging). Rated medium severity (CVSS 4.9), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Rated medium severity (CVSS 4.9), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Options). Rated low severity (CVSS 1.8). No vendor patch available.
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. This Uncontrolled Resource Consumption vulnerability could allow attackers to cause denial of service by exhausting system resources.
Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: Internal Operations). Rated medium severity (CVSS 6.3).
Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General). Rated medium severity (CVSS 6.3). No vendor patch available.
Due to the formatting logic of the "console.table()" function it was not safe to allow user controlled input to be passed to the "properties" parameter while simultaneously passing a plain object. Rated high severity (CVSS 8.2), this vulnerability is remotely exploitable, no authentication required, low attack complexity.