This vulnerability in the MySQL Cluster component (NDB Operator) allows unauthenticated network attackers to compromise the cluster by causing hangs or frequent crashes (complete denial of service) and unauthorized modification of some accessible data (update, insert, delete). It affects multiple supported versions: 8.0.0 to 8.0.47, 8.4.0 to 8.4.10, and 9.7.0 to 9.7.1. The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H, reflecting network attack vector, low attack complexity, no privileges or user interaction required, unchanged scope, no confidentiality impact, limited integrity impact, and high availability impact. Oracle's advisory confirms the availability of patches in versions beyond these ranges (e.g., 8.0.48, 8.4.11, 9.7.2).

Successful exploitation can cause a complete denial of service by hanging or crashing the MySQL Cluster and unauthorized modification (update, insert, delete) of some accessible data. There is no confidentiality impact reported. The vulnerability allows unauthenticated attackers with network access to exploit the flaw, increasing risk.

Oracle has released security patches that address this vulnerability in MySQL Cluster versions 8.0.48, 8.4.11, and 9.7.2 and later. Customers should apply these official patches without delay to remediate the issue. Oracle strongly recommends remaining on actively supported versions and promptly applying security updates. No alternative mitigations or workarounds are specified in the advisory.