CVE-2026-70724: Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise MySQL Cluster. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of MySQL Cluster. in Oracle Corporation MySQL Cluster
CVE-2026-70724 is a high-severity vulnerability in Oracle MySQL Cluster affecting versions 8.0.0 through 8.0.48, 8.4.0 through 8.4.11, and 9.7.0 through 9.7.2. It allows an unauthenticated attacker with network access via HTTP to potentially take over the MySQL Cluster. Exploitation is difficult and requires human interaction from a person other than the attacker. The vulnerability impacts confidentiality, integrity, and availability of the affected systems.
AI Analysis
Technical Summary
This vulnerability in Oracle MySQL Cluster (component: Cluster: General) allows an unauthenticated attacker with network access via HTTP to compromise the MySQL Cluster. Successful exploitation requires user interaction from a third party. The CVSS 3.1 base score is 7.5, indicating high severity with impacts on confidentiality, integrity, and availability. Affected versions include 8.0.0 to 8.0.48, 8.4.0 to 8.4.11, and 9.7.0 to 9.7.2. Oracle has published a Critical Security Patch Update in August 2026 addressing this and many other vulnerabilities, strongly recommending patching to mitigate risks.
Potential Impact
Successful exploitation can lead to full takeover of the MySQL Cluster, compromising confidentiality, integrity, and availability of the database cluster. The attack requires network access via HTTP and user interaction from a person other than the attacker, making exploitation difficult but impactful if achieved.
Mitigation Recommendations
Oracle has released security patches as part of the August 2026 Critical Security Patch Update that address this vulnerability. Users should apply the official patches promptly to mitigate the risk. Oracle strongly recommends staying on actively supported versions and applying security patches without delay. No alternative mitigations or workarounds are specified in the advisory.
CVE-2026-70724: Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise MySQL Cluster. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of MySQL Cluster. in Oracle Corporation MySQL Cluster
Description
CVE-2026-70724 is a high-severity vulnerability in Oracle MySQL Cluster affecting versions 8.0.0 through 8.0.48, 8.4.0 through 8.4.11, and 9.7.0 through 9.7.2. It allows an unauthenticated attacker with network access via HTTP to potentially take over the MySQL Cluster. Exploitation is difficult and requires human interaction from a person other than the attacker. The vulnerability impacts confidentiality, integrity, and availability of the affected systems.
CVSS v3.1
Score 7.5high
Affected software
Oracle Corporation
MySQL Cluster
pkg:maven/com.mysql/mysql-clusterRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability in Oracle MySQL Cluster (component: Cluster: General) allows an unauthenticated attacker with network access via HTTP to compromise the MySQL Cluster. Successful exploitation requires user interaction from a third party. The CVSS 3.1 base score is 7.5, indicating high severity with impacts on confidentiality, integrity, and availability. Affected versions include 8.0.0 to 8.0.48, 8.4.0 to 8.4.11, and 9.7.0 to 9.7.2. Oracle has published a Critical Security Patch Update in August 2026 addressing this and many other vulnerabilities, strongly recommending patching to mitigate risks.
Potential Impact
Successful exploitation can lead to full takeover of the MySQL Cluster, compromising confidentiality, integrity, and availability of the database cluster. The attack requires network access via HTTP and user interaction from a person other than the attacker, making exploitation difficult but impactful if achieved.
Mitigation Recommendations
Oracle has released security patches as part of the August 2026 Critical Security Patch Update that address this vulnerability. Users should apply the official patches promptly to mitigate the risk. Oracle strongly recommends staying on actively supported versions and applying security patches without delay. No alternative mitigations or workarounds are specified in the advisory.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- oracle
- Date Reserved
- 2026-08-04T22:06:34.592Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Vendor Advisory Urls
- [{"url":"https://www.oracle.com/security-alerts/cspuaug2026.html","vendor":"Oracle"}]
Threat ID: 6a84c9f6c6e8be0332bf18f1
Added to database: 08/18/2026, 21:09:10 UTC
Last enriched: 09/11/2026, 16:19:32 UTC
Last updated: 10/04/2026, 02:46:06 UTC
Views: 44
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.