JSON Vulnerability in MySQL Server and MySQL Cluster by Oracle
CVE-2026-101785

8.3HIGH

Key Information:

Vendor

Oracle
Status
Mysql Server
Mysql Cluster
Vendor
CVE Published:
20 October 2026

What is CVE-2026-101785?

A vulnerability exists in the JSON component of Oracle's MySQL Server and MySQL Cluster that could be easily exploited by low-privileged attackers with network access. This issue allows unauthorized actions such as the creation, deletion, or modification of vital data. Attackers could also gain unauthorized read access to critical information or cause disruptions leading to potential denial of service for these database systems. It is crucial for organizations utilizing affected versions to assess their exposure and apply necessary mitigations as outlined in Oracle’s security advisory.

Affected Version(s)

MySQL Cluster 8.0.0-8.0.49

MySQL Cluster 8.4.0-8.4.12

MySQL Cluster 9.7.0-9.7.3

References

https://www.oracle.com/security-alerts/cpuoct2026.html
vendor-advisory

CVSS V3.1

Score:
8.3
Severity:
HIGH
Confidentiality:
Low
Integrity:
High
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.