{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-101781", "assignerOrgId": "43595867-4340-4103-b7a2-9a5208d29a85", "state": "PUBLISHED", "assignerShortName": "oracle", "dateReserved": "2026-09-28T15:40:09.506Z", "datePublished": "2026-10-20T21:22:53.686Z", "dateUpdated": "2026-10-22T15:16:42.399Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "43595867-4340-4103-b7a2-9a5208d29a85", "shortName": "oracle", "dateUpdated": "2026-10-20T21:22:53.686Z"}, "problemTypes": [{"descriptions": [{"lang": "en-US", "description": "Easily exploitable vulnerability allows unauthenticated attacker with access to the physical communication segment attached to the hardware where the MySQL Server, MySQL Cluster executes to compromise MySQL Server, MySQL Cluster. Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster."}]}], "affected": [{"vendor": "Oracle Corporation", "product": "MySQL Server", "versions": [{"version": "8.4.0-8.4.12", "status": "affected"}, {"version": "9.7.0-9.7.3", "status": "affected"}, {"version": "26.7.0-26.7.1", "status": "affected"}]}, {"vendor": "Oracle Corporation", "product": "MySQL Cluster", "versions": [{"version": "8.0.0-8.0.49", "status": "affected"}, {"version": "8.4.0-8.4.12", "status": "affected"}, {"version": "9.7.0-9.7.3", "status": "affected"}, {"version": "26.7.0-26.7.1", "status": "affected"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:oracle:mysql_server:*:*:*:*:*:*:*:*", "versionStartIncluding": "8.4.0", "versionEndIncluding": "8.4.12"}, {"vulnerable": true, "criteria": "cpe:2.3:a:oracle:mysql_server:*:*:*:*:*:*:*:*", "versionStartIncluding": "9.7.0", "versionEndIncluding": "9.7.3"}, {"vulnerable": true, "criteria": "cpe:2.3:a:oracle:mysql_server:*:*:*:*:*:*:*:*", "versionStartIncluding": "26.7.0", "versionEndIncluding": "26.7.1"}, {"vulnerable": true, "criteria": "cpe:2.3:a:oracle:mysql_cluster:*:*:*:*:*:*:*:*", "versionStartIncluding": "8.0.0", "versionEndIncluding": "8.0.49"}, {"vulnerable": true, "criteria": "cpe:2.3:a:oracle:mysql_cluster:*:*:*:*:*:*:*:*", "versionStartIncluding": "8.4.0", "versionEndIncluding": "8.4.12"}, {"vulnerable": true, "criteria": "cpe:2.3:a:oracle:mysql_cluster:*:*:*:*:*:*:*:*", "versionStartIncluding": "9.7.0", "versionEndIncluding": "9.7.3"}, {"vulnerable": true, "criteria": "cpe:2.3:a:oracle:mysql_cluster:*:*:*:*:*:*:*:*", "versionStartIncluding": "26.7.0", "versionEndIncluding": "26.7.1"}]}]}], "descriptions": [{"lang": "en-US", "value": "Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Group Replication GCS). Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and 26.7.0-26.7.1. Easily exploitable vulnerability allows unauthenticated attacker with access to the physical communication segment attached to the hardware where the MySQL Server, MySQL Cluster executes to compromise MySQL Server, MySQL Cluster. Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)."}], "references": [{"url": "https://www.oracle.com/security-alerts/cpuoct2026.html", "name": "Oracle Advisory", "tags": ["vendor-advisory"]}], "metrics": [{"cvssV3_1": {"attackVector": "ADJACENT_NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH", "version": "3.1", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH"}}]}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-284", "lang": "en", "description": "CWE-284 Improper Access Control"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-10-22T15:12:25.121261Z", "id": "CVE-2026-101781", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-22T15:16:42.399Z"}}]}}

{}

{"affected": [{"affectedData": [{"product": "MySQL Server", "vendor": "Oracle Corporation", "versions": [{"status": "affected", "version": "8.4.0-8.4.12"}, {"status": "affected", "version": "9.7.0-9.7.3"}, {"status": "affected", "version": "26.7.0-26.7.1"}]}, {"product": "MySQL Cluster", "vendor": "Oracle Corporation", "versions": [{"status": "affected", "version": "8.0.0-8.0.49"}, {"status": "affected", "version": "8.4.0-8.4.12"}, {"status": "affected", "version": "9.7.0-9.7.3"}, {"status": "affected", "version": "26.7.0-26.7.1"}]}], "source": "secalert_us@oracle.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Group Replication GCS). Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and 26.7.0-26.7.1. Easily exploitable vulnerability allows unauthenticated attacker with access to the physical communication segment attached to the hardware where the MySQL Server, MySQL Cluster executes to compromise MySQL Server, MySQL Cluster. Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)."}], "id": "CVE-2026-101781", "lastModified": "2026-10-22T16:17:16.590", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "secalert_us@oracle.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-101781", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-10-22T15:12:25.121261Z", "version": "2.0.3"}}]}, "published": "2026-10-20T22:18:33.710", "references": [{"source": "secalert_us@oracle.com", "url": "https://www.oracle.com/security-alerts/cpuoct2026.html"}], "sourceIdentifier": "secalert_us@oracle.com", "vulnStatus": "Undergoing Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-284"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{"bugzilla": {"description": "mysql: mysql: Server takeover via Group Replication GCS", "id": "2557856", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2557856"}, "csaw": false, "cvss3": {"cvss3_base_score": "8.8", "cvss3_scoring_vector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-306", "details": ["A flaw was found in MySQL's Group Replication Group Communication System (GCS). An unauthenticated attacker located on the same adjacent network segment can exploit this vulnerability without requiring privileges or user interaction. Successful exploitation allows the attacker to take over the MySQL server, leading to unauthorized data disclosure, data modification, and denial of service."], "name": "CVE-2026-101781", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "mysql8.4", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "mysql", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "mysql", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Affected", "package_name": "mariadb10.11", "product_name": "Red Hat Hardened Images"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Affected", "package_name": "mariadb11.8", "product_name": "Red Hat Hardened Images"}], "public_date": "2026-10-20T21:22:53Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-101781\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-101781\nhttps://www.oracle.com/security-alerts/cpuoct2026.html"], "statement": "This vulnerability is rated as Important because an unauthenticated adjacent attacker can achieve complete system compromise without requiring prior privileges or user interaction. Standard MySQL installations on Red Hat Enterprise Linux do not enable Group Replication by default, leaving typical standalone deployments unaffected. Risk is confined to environments where Group Replication is actively configured and group communication ports are accessible from untrusted adjacent networks.", "threat_severity": "Important"}