CVE-2026-22015
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk15th percentile - higher than 15% of all known CVEs
Summary
Vulnerability in Oracle MySQL Server (Server: Information Schema component) affects versions 8.0.0-8.0.45, 8.4.0-8.4.8 and 9.0.0-9.6.0. A low-privileged attacker with network access can easily exploit it to gain unauthorized read access to a subset of MySQL Server data.
Risk Assessment
This can lead to leakage of some database information by a low-privileged user. It impacts data confidentiality.
Recommendation
Update MySQL Server to a version containing the fix (outside the listed ranges) and apply least-privilege principles to database accounts.
Other vulnerabilities in MySQL Server
See all- CVE-2026-101637Medium
Vulnerability in MySQL Server and MySQL Cluster (component InnoDB) versions 9.7.0-9.7.3 and 26.7.0-26.7.1. It allows a high-privileged attacker with network access via multiple protocols to cause a hang or frequently repeatable crash (complete DoS) and unauthorized modification of some data.
- CVE-2026-101629Medium
A vulnerability in Oracle MySQL (InnoDB component) affects MySQL Server 9.7.0-9.7.3 and 26.7.0-26.7.1, and MySQL Cluster in the same versions. A high-privileged attacker with network access can cause a hang or frequently repeatable crash (complete DoS) of the server or cluster.
- CVE-2026-101627Medium
A vulnerability in Oracle MySQL (InnoDB component) affects MySQL Server 8.4.0-8.4.12, 9.7.0-9.7.3 and 26.7.0-26.7.1, and MySQL Cluster 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and 26.7.0-26.7.1. A high-privileged attacker with network access can cause a hang or frequently repeatable crash (complete DoS), although exploitation is difficult.
- CVE-2026-101624Medium
A vulnerability in Oracle MySQL (InnoDB component) affects MySQL Server 8.4.0-8.4.12, 9.7.0-9.7.3 and 26.7.0-26.7.1, and MySQL Cluster 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and 26.7.0-26.7.1. A high-privileged attacker with network access can cause a hang or frequently repeatable crash (complete DoS).
- CVE-2026-101623Medium
A vulnerability in Oracle MySQL (Server: Optimizer component) affects MySQL Server 8.4.0-8.4.12, 9.7.0-9.7.3 and 26.7.0-26.7.1, and MySQL Cluster 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and 26.7.0-26.7.1. A high-privileged attacker with network access can cause a hang or frequently repeatable crash (complete DoS).
- CVE-2026-101622Medium
A vulnerability in Oracle MySQL (InnoDB component) affects MySQL Server 8.4.0-8.4.12, 9.7.0-9.7.3 and 26.7.0-26.7.1, and MySQL Cluster 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and 26.7.0-26.7.1. A high-privileged attacker with network access can cause a hang or frequently repeatable crash (complete DoS).
- CVE-2026-101621Medium
A vulnerability in Oracle MySQL (InnoDB component) affects MySQL Server 8.4.0-8.4.12, 9.7.0-9.7.3 and 26.7.0-26.7.1, and MySQL Cluster 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and 26.7.0-26.7.1. A high-privileged attacker with network access can cause a hang or frequently repeatable crash (complete DoS).
- CVE-2026-101620Medium
A vulnerability in Oracle MySQL (Server: Optimizer component) affects MySQL Server 9.7.0-9.7.3 and MySQL Cluster 9.7.0-9.7.3. A low-privileged attacker with network access can cause a hang or frequently repeatable crash (complete DoS).
- CVE-2026-101619Medium
Vulnerability in MySQL Server and MySQL Cluster (InnoDB component) allows a high-privileged attacker with network access to cause a hang or frequently repeatable crash (complete DoS) of the server. Affects MySQL Server 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1 and MySQL Cluster 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1.
- CVE-2026-101618Medium
Vulnerability in MySQL Server and MySQL Cluster (InnoDB component) allows a high-privileged attacker with network access to cause a hang or frequently repeatable crash (complete DoS) of the server. Affects MySQL Server 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1 and MySQL Cluster 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1.
Original NVD description (English source)
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Information Schema). Supported versions that are affected are 8.0.0-8.0.45, 8.4.0-8.4.8 and 9.0.0-9.6.0. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized read access to a subset of MySQL Server accessible data. CVSS 3.1 Base Score 4.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N).
Vulnerability data from NVD (NIST) · CISA KEV · EPSS