/
← Voltar ao feed
high

CERT-FR flags multiple Oracle MySQL vulnerabilities, including remote code execution, in the October 2026 CPU

1 fonte(s) · 1 atualização(ões) · publicado 20/10/2026 21:00 · coletado há 22 horas

CERT-FR has published an advisory on multiple vulnerabilities in Oracle MySQL, tied to the Oracle Critical Patch Update cpuoct2026 of 20 October 2026. According to the advisory, the flaws allow an attacker to achieve remote arbitrary code execution, remote denial of service, breaches of data confidentiality and integrity, and security policy bypass. The advisory lists more than 200 CVEs across MySQL Server, MySQL Cluster, MySQL Enterprise Backup, MySQL Router and several MySQL Connectors. It does not mention active exploitation, IOCs or attribution.

Entenda a falha

A vulnerabilidade

CERT-FR advisory CERTFR-2026-AVI-1351 covers more than 200 CVEs in Oracle MySQL, fixed in the Oracle Critical Patch Update cpuoct2026 of 20 October 2026. It says they allow remote arbitrary code execution, remote denial of service, loss of data confidentiality and integrity, and security policy bypass. Affected: MySQL Server 8.4.0-8.4.12, 9.7.0-9.7.3 and 26.7.0-26.7.1; MySQL Cluster 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and 26.7.0-26.7.1; Enterprise Backup 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and 26.7.0; Router 26.7.0; and Connector/J, Net, ODBC and Python 26.7.x. The advisory gives no CVSS scores, does not map impact to individual CVEs, and does not state attacker prerequisites, so the most severe CVE cannot be identified. Fixed versions are in the Oracle bulletin, not in the advisory.

Como funciona

The advisory does not describe how any of these flaws work. It does not say what input or event reaches which component, nor at which step the processing fails. With no per-CVE detail, no process can be reconstructed without guessing. Defenders need the individual CVE records and the Oracle bulletin for that.

Por que é vulnerável

The sources do not state the root cause of any of the listed CVEs. The advisory only lists impact categories (code execution, denial of service, confidentiality and integrity loss, policy bypass) across the whole batch. It also does not say why the flaws went unnoticed or what the fixes change in the code.

Como foi descoberta

The sources do not say who found the flaws or how. CERT-FR published its advisory on 21 October 2026, based on Oracle's quarterly Critical Patch Update cpuoct2026 of 20 October 2026. The advisory does not mention active exploitation, IOCs or attribution. It lists CVE IDs from both 2025 and 2026.

Explicação gerada por IA a partir da matéria e dos artigos, em 22/10/2026 13:25.

Detalhes técnicos

  • Affected: MySQL Server 8.4.0 to 8.4.12, 9.7.0 to 9.7.3 and 26.7.0 to 26.7.1.
  • MySQL Cluster 8.0.0 to 8.0.49 (the advisory also lists 8.0.0 to 8.0.37), 8.4.0 to 8.4.12, 9.7.0 to 9.7.3 and 26.7.0 to 26.7.1.
  • MySQL Enterprise Backup 8.0.0 to 8.0.49, 8.4.0 to 8.4.12, 9.7.0 to 9.7.3 and 26.7.0.
  • MySQL Router 26.7.0.
  • Connector/J 26.7.0, Connector/Net 26.7.0, Connector/ODBC 26.7.1 and Connector/Python 26.7.0.
  • The advisory references CVEs from 2025 (e.g. CVE-2025-10148, CVE-2025-15467) and 2026. It gives no CVSS scores and does not map impact to individual CVEs.

Remediação

  • Consult the Oracle MySQL security bulletin cpuoct2026 and apply the fixed releases it lists.
  • Prioritise internet-exposed and clustered MySQL deployments.

Linha do tempo

  1. cert.ssi.gouv.fr ↗ · pub. 20/10/2026 21:00 · coletado 22/10 13:01 primeiro registro

    CERT-FR flags multiple Oracle MySQL vulnerabilities, including remote code execution, in the October 2026 CPU

    ler a análise desta fonte

    CERT-FR has published an advisory on multiple vulnerabilities in Oracle MySQL, tied to the Oracle Critical Patch Update cpuoct2026 of 20 October 2026. According to the advisory, the flaws allow an attacker to achieve remote arbitrary code execution, remote denial of service, breaches of data confidentiality and integrity, and security policy bypass. The advisory lists more than 200 CVEs across MySQL Server, MySQL Cluster, MySQL Enterprise Backup, MySQL Router and several MySQL Connectors. It does not mention active exploitation, IOCs or attribution.

    Technical Details

    • Affected: MySQL Server 8.4.0 to 8.4.12, 9.7.0 to 9.7.3 and 26.7.0 to 26.7.1.
    • MySQL Cluster 8.0.0 to 8.0.49 (the advisory also lists 8.0.0 to 8.0.37), 8.4.0 to 8.4.12, 9.7.0 to 9.7.3 and 26.7.0 to 26.7.1.
    • MySQL Enterprise Backup 8.0.0 to 8.0.49, 8.4.0 to 8.4.12, 9.7.0 to 9.7.3 and 26.7.0.
    • MySQL Router 26.7.0.
    • Connector/J 26.7.0, Connector/Net 26.7.0, Connector/ODBC 26.7.1 and Connector/Python 26.7.0.
    • The advisory references CVEs from 2025 (e.g. CVE-2025-10148, CVE-2025-15467) and 2026. It gives no CVSS scores and does not map impact to individual CVEs.

    Remediation

    • Consult the Oracle MySQL security bulletin cpuoct2026 and apply the fixed releases it lists.
    • Prioritise internet-exposed and clustered MySQL deployments.