Copyright © 2012 Red Hat, Inc. All rights reserved. Important 2026-10-20T21:22:55 mysql: mysql: Server takeover by a privileged network attacker 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H CWE-267

Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are MySQL Server: 26.7.0-26.7.1; MySQL Cluster: 26.7.0-26.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster. Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).

A flaw was found in the MySQL Server Optimizer component. A remote attacker with high privileges and network access via multiple protocols can exploit this vulnerability. Successful attacks can result in an unauthorized takeover of the MySQL Server or MySQL Cluster.

This vulnerability is rated with an Important impact because a remotely authenticated attacker possessing administrative privileges could completely compromise the database instance, causing total loss of system confidentiality, integrity, and availability. The prerequisite for high-level credentials limits the blast radius and prevents this flaw from meeting the Critical threshold. Red Hat Enterprise Linux is not affected by this issue, as the vulnerable query optimizer implementation is not present in the MySQL or MariaDB packages shipped across supported Red Hat offerings. Red Hat Enterprise Linux 10 Not affected mysql8.4 Red Hat Enterprise Linux 6 Not affected mysql Red Hat Enterprise Linux 9 Not affected mysql Red Hat Hardened Images Not affected mariadb10.11 Red Hat Hardened Images Not affected mariadb11.8 https://www.cve.org/CVERecord?id=CVE-2026-101786 https://nvd.nist.gov/vuln/detail/CVE-2026-101786 https://www.oracle.com/security-alerts/cpuoct2026.html