This vulnerability (CVE-2026-22001) affects Oracle MySQL Server's Information Schema component in multiple supported versions. It permits a high privileged attacker with network access to read unauthorized data subsets from the server. The attack vector is network-based with low attack complexity, requiring high privileges but no user interaction. The impact is limited to confidentiality loss without affecting integrity or availability. The vulnerability is included in Oracle's April 2026 Critical Patch Update, which addresses 481 security issues across Oracle products. Oracle's advisory emphasizes the importance of applying these cumulative patches promptly to mitigate known vulnerabilities, including this one.

Successful exploitation allows unauthorized read access to some data accessible by MySQL Server, potentially exposing sensitive information. There is no impact on data integrity or availability. The vulnerability requires a high privileged attacker with network access, limiting the scope of potential attackers. No known exploits in the wild have been reported as of the advisory date.

Oracle has released a Critical Patch Update in April 2026 that includes patches addressing this vulnerability among others. Customers should apply the April 2026 Critical Patch Update promptly to remediate this issue. Oracle strongly recommends remaining on actively supported versions and applying security patches without delay. Patch status is confirmed by the vendor advisory; no alternative mitigations are indicated.