NCSC-NL Advisory on Oracle MySQL CPU Flaws
Free public brief. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them, no card.
Oracle's October 2026 CPU patches 98 MySQL vulnerabilities, including unauthenticated remotely exploitable flaws up to CVSS 9.8.
NCSC-NL published a security advisory summarizing Oracle's October 2026 Critical Patch Update affecting Oracle MySQL Server, MySQL Cluster, MySQL Enterprise Backup, MySQL Connectors (including Connector/ODBC), and MySQL Router. The update addresses 98 new security patches across these components, of which 29 can be exploited remotely without authentication. Vulnerability classes include classic buffer overflow (buffer copy without checking input size), improper validation of certificates with host mismatch, improper verification of cryptographic signature, and out-of-bounds write conditions. Potential impact includes unauthorized access to or modification of data and denial-of-service against affected systems.
The highest CVSS v3 score among the listed CVEs is 9.8 (CVE-2025-15467 and CVE-2026-9547), indicating critical remotely-exploitable issues without authentication. Several other CVEs carry high scores (7.0–8.8), affecting various MySQL components with severity and impact dependent on the specific component and configuration. OpenSSL, curl, and Oracle have all released updates addressing underlying vulnerabilities feeding into the MySQL product stack. No in-the-wild exploitation is indicated in this advisory; it is a vendor patch notification rather than an active-exploitation report.
Defenders running Oracle MySQL Server, MySQL Cluster, MySQL Enterprise Backup, MySQL Connectors, or MySQL Router should prioritize patching per Oracle's October 2026 CPU, especially for the unauthenticated remote vulnerabilities (CVSS 9.8) and other high-severity issues affecting network-facing components. Review configuration exposure for Connector/ODBC and Router deployments, and ensure OpenSSL/curl dependencies are updated alongside Oracle's patches.
Mentioned in this report
Source reporting: https://advisories.ncsc.nl/2026/ncsc-2026-0441.html
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 13,774 reports from 143 sources, 495 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs