This vulnerability affects Oracle MySQL Router versions 9.0.0 through 9.7.0 and allows an unauthenticated attacker with network access via HTTP to compromise the MySQL Router, resulting in full takeover. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) indicates network attack vector, low attack complexity, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability. Oracle has published a Critical Security Patch Update in June 2026 that includes fixes for this vulnerability among 245 others. The advisory emphasizes the importance of applying patches without delay and suggests possible temporary mitigations such as blocking network protocols or removing unnecessary privileges, though these may affect application functionality.

Successful exploitation allows an unauthenticated remote attacker to fully compromise MySQL Router, resulting in complete loss of confidentiality, integrity, and availability of the affected component. This can lead to full takeover of the MySQL Router, potentially impacting the security and operation of systems relying on it.

Oracle has released a Critical Security Patch Update in June 2026 that addresses this vulnerability. Customers are strongly advised to apply the June 2026 Critical Security Patch Update promptly to remediate this issue. Until patches are applied, risk may be reduced by blocking network protocols required for exploitation or by removing unnecessary privileges from users, though these measures may disrupt normal application functionality. Oracle recommends remaining on actively supported versions and applying security patches without delay.