CVE-2026-46862 is a vulnerability in Oracle MySQL Router (component: Router: General) affecting versions 8.4.0-8.4.9 and 9.0.0-9.7.0. It allows an unauthenticated attacker with network access via TLS to cause a hang or repeated crash of MySQL Router, resulting in a complete denial of service. The CVSS 3.1 base score is 7.5, reflecting high impact on availability with no impact on confidentiality or integrity. Oracle has published this vulnerability as part of its June 2026 Critical Security Patch Update advisory. While the advisory does not specify exact patched versions, it strongly recommends applying the update promptly. The vulnerability is easily exploitable but no known exploits in the wild have been reported.

Successful exploitation of this vulnerability results in denial of service by causing MySQL Router to hang or crash repeatedly. This impacts the availability of MySQL Router services but does not compromise confidentiality or integrity of data. The vulnerability can be exploited remotely without authentication over TLS.

Oracle strongly recommends applying the June 2026 Critical Security Patch Update, which includes fixes for this vulnerability. Customers should remain on actively supported versions and apply the security patches without delay. Until patches are applied, risk may be reduced by blocking network protocols required for the attack, though this may affect functionality. No official temporary fix or workaround is detailed in the advisory.