CVE-2026-22015 is a vulnerability in the Information Schema component of Oracle MySQL Server versions 8.0.0-8.0.45, 8.4.0-8.4.8, and 9.0.0-9.6.0. It allows a low privileged attacker with network access via multiple protocols to obtain unauthorized read access to certain MySQL Server data. The vulnerability has a CVSS 3.1 base score of 4.3, indicating a medium severity with a confidentiality impact only. The vulnerability is included in Oracle's April 2026 Critical Patch Update, which addresses multiple security issues across Oracle products, including MySQL Server. The advisory strongly urges customers to apply the update promptly. No specific exploit details or active exploitation reports are available.

Successful exploitation of this vulnerability can lead to unauthorized disclosure of a subset of data accessible by the MySQL Server. There is no impact on data integrity or availability. The attacker requires low privileges and network access but no user interaction. No known exploits are reported in the wild.

Oracle has released the April 2026 Critical Patch Update which includes security patches addressing this vulnerability among others. Customers should apply this update promptly to remediate the issue. Since the advisory does not explicitly confirm patch availability for this specific vulnerability outside the cumulative update, users must refer to the April 2026 Critical Patch Update documentation for installation instructions and ensure their MySQL Server versions are updated accordingly. No alternative mitigations or workarounds are provided by Oracle.