CVE-2026-46863

No known exploitation. EPSS puts it in the 40th percentile. A vendor fix is available.

CVSS 3.17.5High EPSS percentile40th0.5% chance in 30 days CISA KEVNot listedNo confirmed exploitation
No public exploit known FixVendor fixNo build named by the sources

Published 2026-06-16Updated 2026-06-18Sources: CVE.org, NVD

NVD CVE.org

What to do

The vendor has published a fix. Version details are below where the sources state them.

Oracle Corporation MySQL ServerAffected: 8.4.0-8.4.9Upgrade to: not statedAffected: 9.0.0-9.7.0Upgrade to: not statedStated by: CVE record
Oracle Corporation MySQL ClusterAffected: 8.0.11-8.0.46Upgrade to: not statedAffected: 8.4.0-8.4.9Upgrade to: not statedAffected: 9.0.0-9.7.0Upgrade to: not statedStated by: CVE record

Versions as the sources state them. Full version matrix after sign-in

Steps

Written by AI from the record

Check the version of MySQL running on every server and compare it with the affected ranges above.
Ask your IT provider to apply Oracle's vendor remediation; the findings do not provide an exact fixed version number.
Until updated, limit database network access to only the application servers and administrators that require it.
Check for database hangs, crashes, or unusual connection activity after the change.

Vendor advisory Some work to apply

Check it yourselfA free OpenVAS check exists for this CVE. Run it against your hosts.Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Connection Handling). Supported versions that are affected are MySQL Server: 8.4.0-8.4.9, 9.0.0-9.7.0; MySQL Cluster: 8.0.11-8.0.46, 8.4.0-8.4.9 and 9.0.0-9.7.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).

In plain language

Written by AI from the record

This can let an outsider make MySQL stop working; typical small businesses should act promptly if running MySQL Server 8.4.0-8.4.9 or 9.0.0-9.7.0, or MySQL Cluster 8.0.11-8.0.46, 8.4.0-8.4.9, or 9.0.0-9.7.0.

Unauthenticated network-reachable denial of service in MySQL connection handling, allowing repeated hangs or complete crashes through multiple protocols.

If you're affected

Database outages
Application downtime
Interrupted customer service
Operational disruption

What is it

This is a flaw in how MySQL handles incoming connections. Think of it as someone repeatedly jamming the front door to your stockroom until staff can no longer get in: the database may freeze or crash, stopping the systems that rely on it.

Who is affected

This matters to you if you run MySQL for a website, business application, reporting system, or customer-facing service. An attacker does not need a login; this is only a risk where MySQL is reachable over a network.

How urgent is it

Treat this as an Amber priority: a remote attacker can disrupt your database service. No confirmed active exploitation, CISA Known Exploited Vulnerabilities listing, or public exploit code is on record, so schedule remediation promptly rather than treating it as an active emergency.

What to do — in detail

Confirm deployed MySQL versions on all standalone servers and cluster nodes, then identify any listeners exposed beyond trusted application hosts and administration networks. Upgrade through Oracle's June 2026 security advisory to the vendor-remediated release for the applicable supported branch; the supplied findings do not name exact fixed versions, so validate them in the advisory before deployment. Test the upgrade in a representative environment and follow the normal rolling-maintenance process for clustered deployments to reduce downtime. If patching is delayed, restrict database access with network controls to approved application and administrative hosts, and remove unnecessary externally reachable listeners. No CISA KEV due date applies because this CVE is not listed in KEV. Monitor database availability, connection-error rates, hangs, crash/restart events, and unexpected connection sources.

Technical context

CVE-2026-46863 is CVSS 7.5 High (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), associated with CWE-400. It is an unauthenticated network attack against Server: Connection Handling that can cause a hang or frequently repeatable complete denial of service via multiple protocols. CISA KEV does not list it, no public exploit code is recorded, and EPSS is 0.5% at the 40th percentile with a flat trend. Press attention is rising but is not evidence of exploitation.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS40th

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

0.5% chance of exploitation activity in the next 30 days, which ranks it in the 40th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

6 events over 9 days, from the signal feeds we watch.

2026-06-25OpenVAS check added
2026-06-18Patch availablerecord updated
2026-06-16Publishedweakness classified, att&ck mapped

Affected products

Oracle Corporationcommercial · USaka oracle, oracle corp.
- MySQL ServerDatabaseOn-premDatabases / relational
- MySQL ClusterDatabaseOn-premDatabases / relational

And 2 more affected products. See all after sign-in

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Scored 7.5 by NVD.

How it is reached

Attack Vector NetworkExploitable remotely over the network without any special conditions
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required NoneNo authentication required — anyone can exploit this
User Interaction NoneNo user interaction needed — fully automated exploitation

Scope

Scope UnchangedImpact is limited to the vulnerable component itself

Impact if exploited

Confidentiality NoneNo confidentiality impact
Integrity NoneNo integrity impact
Availability HighTotal denial of service — the component is completely unavailable