Oracle MySQL Server and Cluster: Improper access control in client programs

Summary

Oracle MySQL Server and MySQL Cluster in the affected ranges contain a flaw in the client programs component (CWE-284, improper access control). According to Oracle's description, an unauthenticated attacker with network access via multiple protocols can compromise the server, which can lead to a takeover of MySQL Server or MySQL Cluster. Exploitation is rated difficult (AC:H), with a CVSS 3.1 base score of 8.1. The research notes found no evidence of exploitation or a public proof of concept.

Affected

• MySQL Server 8.4.0-8.4.12
• MySQL Server 9.7.0-9.7.3
• MySQL Server 26.7.0-26.7.1
• MySQL Cluster 8.0.0-8.0.49
• MySQL Cluster 8.4.0-8.4.12
• MySQL Cluster 9.7.0-9.7.3
• MySQL Cluster 26.7.0-26.7.1

Fixed in

• MySQL 8.4: 8.4.13 released 20 Oct 2026. Oracle's release notes do not name this CVE, so the fix is unconfirmed.
• MySQL 9.7: 9.7.4 LTS released 20 Oct 2026 (per Oracle blog; not confirmed for this CVE).
• MySQL 26.x: 26.10.0 per Tenable data (not confirmed against Oracle's advisory).
• MySQL Cluster 8.0: 8.0.50 per Tenable data (not confirmed against Oracle's advisory).
• Branch 26.7: FreeBSD reports no fix available; upgrade to 26.10 is the likely path.

Workaround

Unknown. No vendor-documented workaround was found; patching is the only fix listed in the sources.

Exploitation

No evidence of exploitation in the wild or public proof of concept found. CISA SSVC: exploitation none, automatable no. EPSS is very low (0.00348). CISA KEV was not checked directly.

Our recommendation

• Patch MySQL Server and MySQL Cluster to a fixed release for your branch, starting with internet-facing and shared servers.
• Plan upgrades for installations on 8.0, 8.4.0-8.4.12, 9.7.0-9.7.3 or 26.7.x.
• Restrict network access to MySQL ports to required hosts only.
• Patch database client tools and machines that connect to database servers you do not fully control.
• Ask managed service or hosting providers to confirm that the update is applied.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Oracle Critical Patch Update October 2026 www.oracle.com
• MySQL 8.4.13 release notes dev.mysql.com
• MySQL October 2026 GA releases blog blogs.oracle.com
• Ubuntu CVE tracker ubuntu.com
• Vulners / Tenable plugin data vulners.com
• CNNVD record vulners.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 18:25.