CVE-2025-21540

What it actually does

The flaw in the Server: Security: Privileges component allows a low-privileged network attacker to bypass authorization checks, resulting in unauthorized update/insert/delete and partial read access to MySQL Server data.

Why it matters to the business

Attackers can alter or view portions of database data without proper authorization, risking data integrity, confidentiality breaches, and compliance issues; low urgency given stable low EPSS and absence from KEV.

How an attack unfolds

A low-privileged attacker with network access connects to the MySQL Server via supported protocols and sends crafted requests that exploit the privilege enforcement gap to perform unauthorized data modifications and reads.

How to fix it

Upgrade affected MySQL Server installations to versions later than 8.0.40, 8.4.3, and 9.1.0 as provided in Oracle's security updates; apply the exact fixed versions listed for each supported release.

How to confirm the fix worked

Confirm MySQL Server version is updated beyond the affected releases and validate that privilege enforcement prevents unauthorized operations by low-privileged accounts.

Typical attack path

1. Obtain low-privileged network access to an affected MySQL instance
2. Connect using multiple protocols
3. Issue specially crafted commands or queries
4. Bypass privilege checks to perform unauthorized data operations

How to detect it

Review MySQL audit and general query logs for unexpected data modifications or reads performed by low-privileged accounts; correlate with connection attempts from untrusted sources.

What your security team should do

• Prioritize patching MySQL Server instances to the fixed versions
• Audit and minimize granted privileges for network-accessible accounts
• Enable enhanced logging for privilege-related operations