CVE-2026-70724: High severity Oracle MySQL Cluster vulnerability
Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General). Supported versions that are affected are 8.0.0-8.0.48, 8.4.0-8.4.11 and 9.7.0-9.7.2. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise MySQL Cluster. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of MySQL Cluster. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H).
Affected Software
Event History
Frequently Asked Questions
Which deployments are in scope?
Oracle MySQL Cluster deployments running 8.0.0 through 8.0.48, 8.4.0 through 8.4.11, or 9.7.0 through 9.7.2 are affected.
What conditions must an attacker meet to exploit this issue?
The attacker does not need prior authentication, but must have network access via HTTP. Exploitation is difficult and requires interaction by someone other than the attacker.
What could a successful attack do?
A successful attack can result in takeover of MySQL Cluster, with high impacts to confidentiality, integrity, and availability.