CVE-2026-70724
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk21th percentile - higher than 21% of all known CVEs
Summary
Vulnerability in MySQL Cluster (component: Cluster: General) affects versions 8.0.0-8.0.48, 8.4.0-8.4.11, and 9.7.0-9.7.2. An unauthenticated attacker can take over MySQL Cluster over HTTP with user interaction.
Risk Assessment
Risk is high – full cluster takeover, potentially leading to confidentiality, integrity, and availability breaches. Exploitation is difficult but impact is critical.
Recommendation
Apply patches from Oracle. Restrict network access to the cluster and educate users about interacting with untrusted content.
Other vulnerabilities in MySQL Cluster
See all- CVE-2026-60592High
Vulnerability in Oracle's MySQL Cluster product (component: Cluster: NDB Operator). Affected versions are 8.0.0-8.0.47, 8.4.0-8.4.10 and 9.7.0-9.7.1. Easily exploitable vulnerability allows an unauthenticated attacker with network access via multiple protocols to compromise MySQL Cluster. Successful attacks can cause a hang or frequently repeatable crash (complete DoS) and unauthorized update, insert or delete access to some data.
- CVE-2026-60569Medium
Vulnerability in MySQL Cluster (Cluster: NDB Operator component) versions 8.0.0-8.0.47, 8.4.0-8.4.10, and 9.7.0-9.7.1. An unauthenticated attacker with local access can exploit this vulnerability, potentially leading to unauthorized access to critical data or full access to all MySQL Cluster data.
- CVE-2026-60171Medium
Vulnerability in Oracle MySQL's MySQL Cluster product (component: Server: Optimizer). Affected versions are 8.0.0-8.0.47. Easily exploitable by a high-privileged attacker with network access via multiple protocols, potentially causing a hang or frequent crash (full DOS) of the MySQL Cluster.
Original NVD description (English source)
Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General). Supported versions that are affected are 8.0.0-8.0.48, 8.4.0-8.4.11 and 9.7.0-9.7.2. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise MySQL Cluster. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of MySQL Cluster. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H).
Vulnerability data from NVD (NIST) · CISA KEV · EPSS