CVE-2026-46936 Oracle Corporation CVE debrief

Who should care

System administrators and security teams responsible for MySQL Server and MySQL Cluster installations, particularly those with versions 8.4.0-8.4.10, 9.7.0-9.7.1, 8.0.0-8.0.47, and 8.4.0-8.4.10, should be aware of this vulnerability and take necessary actions to mitigate the risk.

Technical summary

The vulnerability is located in the Server: DDL component of MySQL Server and MySQL Cluster. It has a CVSS 3.1 Base Score of 4.4 (Availability impacts) and a CVSS Vector of (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H). The vulnerability allows a high-privileged attacker with network access via multiple protocols to compromise MySQL Server and MySQL Cluster, potentially leading to a denial-of-service (DOS) condition.

Defensive priority

Medium priority should be given to patching or mitigating this vulnerability, as it can lead to a DOS condition in MySQL Server and MySQL Cluster.

Recommended defensive actions

• Apply the patches provided by Oracle for MySQL Server and MySQL Cluster versions 8.4.0-8.4.10, 9.7.0-9.7.1, 8.0.0-8.0.47, and 8.4.0-8.4.10.
• Restrict network access to MySQL Server and MySQL Cluster to only necessary personnel.
• Monitor MySQL Server and MySQL Cluster for unusual activity or crashes.
• Consider implementing compensating controls, such as network segmentation or access controls, to limit the attack surface.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE record was published on 2026-07-21T22:17:02.160Z and was last modified on 2026-07-27T14:54:30.140Z. The NVD entry is currently Analyzed. The vulnerability has a CVSS 3.1 Base Score of 4.4 (Availability impacts).

Official resources