CVE-2026-46850VulnerabilityPublished 17 Jun 2026

Oracle MySQL-producten · Kwetsbaarheden Verholpen

Affects Nationaal Cyber Security Centrum OracleSource GCVE Database

Compare

Not known to be exploited.

Data as of 8 Nov 2026, 23:24 UTC

Severity

High

Rated High by Threat Radar's AI analysis · No CVSS score from NVD or the CNA

EPSS: 0.5% chance of exploitation in 30 days – higher than 44% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.

Exploitation evidence

Disclosed: evidence found.
CVE published 17 Jun 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponized: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 8 Nov 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponized: A Metasploit exploit module or Exploit-DB entry exists (Metasploit scanner modules do not count), or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

nationaal-cyber-security-centr

What to do

Affected software

Product	Affected	Fixed in
Nationaal Cyber Security Centrum Oracle	Affected >=8.0.11 <=8.0.46 >=8.4.0 <=8.4.9 >=9.0.0 <=9.7.0 >=2026.2.0 <=9.6.1	Fixed in–

AI-suggested

Oracle strongly recommends that customers apply the June 2026 Critical Security Patch Update patches as soon as possible to mitigate the risk of exploitation. Until patches are applied, risk may be reduced by blocking network protocols required by potential attacks and removing unnecessary privileges or access to certain packages from users who do not need them. These workarounds may impact application functionality. Staying on actively-supported versions and promptly applying security patches is the primary recommended mitigation.

Description

Oracle has released a Critical Security Patch Update (CSPU) in June 2026 that addresses multiple vulnerabilities in various Oracle MySQL products including MySQL Shell for VS Code, MySQL Router, MySQL NDB Cluster, and MySQL Server. The update includes 245 security patches across multiple Oracle product families. Oracle strongly recommends applying these patches promptly to mitigate potential exploitation risks. The advisory emphasizes that attackers have attempted to exploit previously patched vulnerabilities where customers failed to apply updates. Workarounds such as blocking certain network protocols or removing unnecessary privileges may reduce risk until patches are applied.

Impact

The vulnerabilities addressed by this update potentially expose affected Oracle MySQL products to security risks that could be exploited if patches are not applied. Oracle reports that attackers have attempted to exploit some of these vulnerabilities in the wild, primarily targeting systems that have not applied available patches. The impact includes potential compromise of affected systems if exploited, though specific exploit details or impacts are not disclosed in the advisory.

Summary

The June 2026 Oracle Critical Security Patch Update addresses numerous security vulnerabilities affecting Oracle MySQL products such as MySQL Shell, MySQL Router, MySQL NDB Cluster, and MySQL Server, among others. This CSPU provides targeted, high-priority fixes designed to be easier to apply with minimal disruption. Oracle has documented affected versions for these products and urges customers to remain on supported versions and apply patches without delay. The advisory notes that some vulnerabilities have been subject to attempted exploitation in the wild, primarily due to unpatched systems. Mitigation options include applying the patches immediately or temporarily blocking network protocols and removing unnecessary privileges. The update is part of Oracle's ongoing security assurance activities and complements prior quarterly Critical Patch Updates.

References

oracle.com/security-alerts/cspujun2026.html (opens in a new tab)

Community reviews

Loading reviews…

Exploitation evidence

What to do

Affected software

Description

AI analysisMachine-generated, updated 7 Nov 2026, 18:05 UTC

Technical details

References

Community reviews

Related threats