CVE-2026-46863: Unauthenticated MySQL Denial-of-Service Vulnerability (CVSS 7.5)

Technical summary

CVE-2026-46863 is an unauth­enticated network-accessible denial-of-service vulnerability in MySQL's connection handling component. The flaw allows attackers to trigger resource exhaustion or improper state management (CWE-400) that causes the MySQL process to hang or crash repeatedly. The vulnerability spans MySQL Server versions 8.4.0 through 8.4.9 and 9.0.0 through 9.7.0, as well as MySQL Cluster versions 8.0.11 through 8.0.46, 8.4.0 through 8.4.9, and 9.0.0 through 9.7.0. The attack is easily reproducible over common network protocols with minimal prerequisites.

Business impact

Organizations relying on MySQL for production databases face immediate risk of service unavailability. Since the attack requires no authentication, every exposed MySQL instance is at risk. A successful exploitation causes a denial-of-service condition that could interrupt business operations, impact customer-facing applications, compromise data pipeline integrity, and necessitate emergency incident response and service restoration. The ease of exploitation and lack of authentication requirements elevate operational urgency for patching.

Affected systems

Oracle MySQL Server versions 8.4.0 through 8.4.9 and 9.0.0 through 9.7.0 are affected. Oracle MySQL Cluster versions 8.0.11 through 8.0.46, 8.4.0 through 8.4.9, and 9.0.0 through 9.7.0 are also affected. Any deployment of these versions exposed to untrusted networks is vulnerable, including cloud-hosted instances, hybrid environments, and on-premises systems with external connectivity.

Exploitability

This vulnerability is easily exploitable. The CVSS vector confirms it requires no privileges (PR:N), no user interaction (UI:N), and has low attack complexity (AC:L). An attacker only needs network access (AV:N) to reach the MySQL port—no authentication, no payload crafting, no social engineering. The reproducible nature of the crash or hang makes this suitable for rapid, scalable exploitation. However, the vulnerability is not yet listed on the CISA Known Exploited Vulnerabilities catalog, meaning in-the-wild active exploitation has not been confirmed as of the publication date.

Remediation

Apply vendor patches immediately. Contact Oracle MySQL for the patched versions addressing versions 8.4.x and 9.0.x of both MySQL Server and MySQL Cluster. Pending patch availability, deploy network segmentation to limit database access to trusted application servers and administrative networks only. Implement connection-rate limiting and monitor for abnormal connection patterns. If upgrading is not immediately feasible, restrict MySQL service exposure and validate patch guidance from the Oracle security advisory.

Patch guidance

Verify patch availability through the Oracle MySQL security advisory and your organization's MySQL distribution channel. Apply patches to all affected MySQL Server instances (8.4.0–8.4.9 and 9.0.0–9.7.0) and all MySQL Cluster deployments within the specified ranges. Test patches in a staging environment replicating production configurations before rolling out to production. Coordinate patching windows to minimize service disruption and validate functionality post-patch.

Detection guidance

Monitor MySQL server logs and system metrics for repeated connection failures, process crashes, or unexpected service restarts. Network-level detection should flag a high volume of connection attempts to the MySQL port from a single source, particularly if connections are dropped immediately after establishment. Database administrators should establish baseline connection metrics and alert on sudden anomalies. Consider increasing logging verbosity on connection-handling components during the patching window to help identify exploitation attempts.

Why prioritize this

This vulnerability merits immediate patching due to its combination of ease of exploitation, lack of authentication requirements, and high availability impact. Any unauthenticated attacker on the network can trivially cause service disruption. The affected versions include recent minor releases (8.4.x, 9.0.x), suggesting many organizations may be running vulnerable code. The reproducibility of crashes makes this practical for attackers and leaves no margin for graceful degradation.

Risk score, explained

The CVSS 3.1 base score of 7.5 (HIGH) reflects an easily exploitable network vulnerability with no authentication or user interaction barriers. While the attack does not compromise confidentiality or integrity, the high availability impact (complete denial of service) elevates risk. Lack of privilege requirements and low attack complexity are the primary drivers of the score. Organizations running these versions should treat this as high-priority remediation; the ease of exploitation and lack of authentication mean every exposed instance is at immediate risk.

Frequently asked questions