Mysql Router
Monthly
Data compromise in Oracle MySQL Router 8.4.0-8.4.10 and 9.7.0-9.7.1 allows a network attacker to gain unauthorized read and write access to all data reachable through the Router component. The flaw is reachable unauthenticated over HTTP (PR:N) but is rated hard to exploit (AC:H), and there is no public exploit identified at time of analysis. Oracle's tagging references an authentication-bypass class of issue, consistent with the unauthenticated network vector.
Denial-of-service in Oracle MySQL Router (versions 8.4.0-8.4.10 and 9.7.0-9.7.1) allows a remote unauthenticated attacker to send crafted HTTP traffic that hangs or repeatedly crashes the Router process, causing a complete availability outage. The flaw is rated CVSS 7.5 with only availability impact (no data confidentiality or integrity loss) and is described by Oracle as 'easily exploitable.' As of this analysis there is no public exploit identified and it is not listed in CISA KEV; the fix ships in Oracle's July 2026 Critical Patch Update.
Denial of service in Oracle MySQL Router 8.4.0-8.4.9 and 9.0.0-9.7.0 allows unauthenticated remote attackers to hang or repeatedly crash the routing service over TLS-enabled network connections, producing a complete DOS of the affected component. CVSS 3.1 scores this 7.5 with availability-only impact, and no public exploit identified at time of analysis. Because MySQL Router brokers application traffic to InnoDB Cluster/ReplicaSet backends, an outage cascades into downstream application unavailability even when the database servers themselves remain healthy.
Remote takeover of Oracle MySQL Router 9.0.0 through 9.7.0 is possible by unauthenticated attackers reaching the Router over HTTP, per Oracle's Critical Patch Update advisory (CPU June 2026). Oracle scores this 9.8 CVSS 3.1 with full confidentiality, integrity, and availability impact, and rates exploitation as easy. No public exploit identified at time of analysis and the CVE is not present in CISA KEV, but the network-reachable, no-auth, low-complexity profile makes it a high-priority patch.
Data compromise in Oracle MySQL Router 8.4.0-8.4.10 and 9.7.0-9.7.1 allows a network attacker to gain unauthorized read and write access to all data reachable through the Router component. The flaw is reachable unauthenticated over HTTP (PR:N) but is rated hard to exploit (AC:H), and there is no public exploit identified at time of analysis. Oracle's tagging references an authentication-bypass class of issue, consistent with the unauthenticated network vector.
Denial-of-service in Oracle MySQL Router (versions 8.4.0-8.4.10 and 9.7.0-9.7.1) allows a remote unauthenticated attacker to send crafted HTTP traffic that hangs or repeatedly crashes the Router process, causing a complete availability outage. The flaw is rated CVSS 7.5 with only availability impact (no data confidentiality or integrity loss) and is described by Oracle as 'easily exploitable.' As of this analysis there is no public exploit identified and it is not listed in CISA KEV; the fix ships in Oracle's July 2026 Critical Patch Update.
Denial of service in Oracle MySQL Router 8.4.0-8.4.9 and 9.0.0-9.7.0 allows unauthenticated remote attackers to hang or repeatedly crash the routing service over TLS-enabled network connections, producing a complete DOS of the affected component. CVSS 3.1 scores this 7.5 with availability-only impact, and no public exploit identified at time of analysis. Because MySQL Router brokers application traffic to InnoDB Cluster/ReplicaSet backends, an outage cascades into downstream application unavailability even when the database servers themselves remain healthy.
Remote takeover of Oracle MySQL Router 9.0.0 through 9.7.0 is possible by unauthenticated attackers reaching the Router over HTTP, per Oracle's Critical Patch Update advisory (CPU June 2026). Oracle scores this 9.8 CVSS 3.1 with full confidentiality, integrity, and availability impact, and rates exploitation as easy. No public exploit identified at time of analysis and the CVE is not present in CISA KEV, but the network-reachable, no-auth, low-complexity profile makes it a high-priority patch.