Oracle MySQL Server and Cluster: Improper access control in JSON component
Summary
A flaw in the JSON component of Oracle MySQL Server and MySQL Cluster (CWE-284, improper access control) allows an attacker with a low-privileged database account and network access to the database to modify or delete data, read a subset of data, and crash or hang the server. CVSS 3.1 base score is 8.3 (High). Exposure of the database port and the existence of any valid account are the main conditions for an attack.
Affected
- MySQL Server 8.4.0 to 8.4.12
- MySQL Server 9.7.0 to 9.7.3
- MySQL Server 26.7.0 to 26.7.1
- MySQL Cluster 8.0.0 to 8.0.49
- MySQL Cluster 8.4.0 to 8.4.12
- MySQL Cluster 9.7.0 to 9.7.3
- MySQL Cluster 26.7.0 to 26.7.1
Fixed in
- Fixed versions per Oracle's October 2026 CPU are not confirmed in the sources reviewed.
- Tenable-derived, unconfirmed: MySQL Server 8.4.13, 9.7.4, 26.10.0; MySQL Cluster 8.0.50.
- MySQL 8.4.13 release is corroborated by third-party release notes.
Workaround
- Unknown. No workaround was found in the sources reviewed.
- Reduce exposure: keep port 3306 off the internet and untrusted network segments.
Exploitation
- No in-the-wild exploitation reported in the sources reviewed. CISA KEV was not checked directly.
- No public proof of concept found for this CVE.
- EPSS 0.00327 (low predicted exploitation probability).
- CISA SSVC: exploitation none, not automatable, partial technical impact.
Our recommendation
- Inventory all MySQL Server and MySQL Cluster instances and their versions.
- Confirm the exact fixed versions in Oracle's October 2026 CPU advisory.
- Apply the October 2026 CPU or the matching MySQL release on all affected branches, prioritising exposed instances.
- Until patched, audit database accounts (remove unused and shared accounts, apply least privilege) and verify that port 3306 is not reachable from untrusted networks.
- Priority: high where MySQL is reachable from the internet or less-trusted networks; medium for internal, single-tenant databases.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Oracle Critical Patch Update Advisory - October 2026 www.oracle.com
- Vulners CVE record CVE-2026-101785 vulners.com
- Tenable Nessus plugin 370444 www.tenable.com
- Ubuntu CVE tracker CVE-2026-101785 ubuntu.com
- Friday We Works: MySQL October 2026 CPU and 8.4.13 release fridayweworks.com
- PT-2026-119296 (affected versions) vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 13:31.
Original description (NVD)
Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: JSON). Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and 26.7.0-26.7.1. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all MySQL Server, MySQL Cluster accessible data as well as unauthorized read access to a subset of MySQL Server, MySQL Cluster accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 8.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H).
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.