Oracle patches critical MySQL flaws enabling RCE
Oracle released patches for multiple vulnerabilities in MySQL products affecting versions 8.0 through 9.7, including flaws enabling remote code execution and denial of service.
Sourcecert.ssi.gouv.fr — open the original
What to check
- Applies to
- The 8 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- No exploitation in the wild and no public exploit is recorded for the CVEs named.
The French national cybersecurity agency CERT-FR has published an advisory concerning multiple vulnerabilities discovered in Oracle MySQL products. The flaws affect a wide range of MySQL components including MySQL Server, MySQL Cluster, MySQL NDB Cluster, MySQL Router, and MySQL Shell across versions 8.0.11 through 9.7.0. The vulnerabilities impact server connection handling, dump and load functionality, and the Shell for VS Code extension.
The security issues enable various attack vectors including remote code execution, remote denial of service, confidentiality breaches, and data integrity violations. Eight CVEs have been assigned to these vulnerabilities (CVE-2026-46850 through CVE-2026-46863, CVE-2026-46869 through CVE-2026-46871). Oracle has released patches as part of their June 2026 Critical Patch Update to address these security flaws.
Organizations running affected MySQL versions should consult Oracle's security bulletin and apply the available patches promptly. The broad version range affected suggests widespread exposure across database deployments in enterprise and cloud environments.
Mentioned in this report
Source reporting: https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0765
Free public brief. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them, no card.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,436 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs