This vulnerability (CVE-2026-46861) affects Oracle MySQL NDB Cluster (component: Cluster: NDB Operator) in versions 8.0.11-8.0.46, 8.4.0-8.4.9, and 9.0.0-9.7.0. It is an easily exploitable vulnerability that allows a low privileged attacker with network access via HTTP to compromise the MySQL NDB Cluster. The scope of impact extends beyond the cluster itself, potentially affecting additional Oracle products. Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data, resulting in complete confidentiality and integrity compromise of all accessible data within the cluster. The CVSS 3.1 base score is 9.6, indicating critical severity with network attack vector, low attack complexity, low privileges required, no user interaction, and scope change. Oracle’s June 2026 Critical Security Patch Update includes fixes for this vulnerability. The vendor strongly recommends applying these patches immediately to prevent exploitation.

Successful exploitation of this vulnerability can result in unauthorized creation, deletion, or modification of critical data within the MySQL NDB Cluster. It compromises confidentiality and integrity of all accessible data, potentially leading to complete data compromise. The vulnerability affects multiple versions of MySQL NDB Cluster and may impact additional Oracle products due to scope change. There is no reported exploitation in the wild at this time, but the high CVSS score and ease of exploitation indicate a significant risk if unpatched.

Oracle has released a Critical Security Patch Update in June 2026 that includes patches addressing CVE-2026-46861. Customers are strongly advised to apply these security patches as soon as possible. Until patches are applied, risk can be partially mitigated by blocking network protocols required for the attack and by removing unnecessary privileges from users who do not need them. However, these mitigations may disrupt application functionality. Oracle recommends remaining on actively supported versions and applying patches without delay. Patch status is confirmed by the vendor advisory, indicating an official fix is available.