Cloudanix VulnDB

CVE-2026-47023

Medium · 4.9

CVSS

4.9

EPSS

0.3%

Published

Jul 21, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A flaw in database replication can let a trusted administrator accidentally or deliberately shut down the database service, causing outages until the software is updated.

Exploitation
Remote Authenticated
Attacker needs
High Privilege
Complexity
Low
Impact
Denial Of Service
Component
Network Service
Class
Denial of service
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Vulnerability in the replication component allows a high-privileged network attacker to trigger a hang or repeatable crash, resulting in complete denial of service to the MySQL Server or Cluster instance.

Why it matters to the business

Successful exploitation causes unplanned database downtime, disrupting dependent applications and services; the issue affects widely deployed MySQL 8.4 and 9.7 releases with public fixes available for 96 days.

How an attack unfolds

An attacker who already possesses high-privileged network credentials connects to the affected MySQL instance over any supported protocol and issues replication-related commands or packets that exercise the flawed code path, causing the server process to hang or terminate.

How to fix it

Upgrade MySQL Server and MySQL Cluster to fixed releases; for Red Hat Enterprise Linux 10 packages, install mysql8.4-8.4.11-1.el10_2 or later via RHSA-2026:56007. Disable unnecessary network access for replication users until patches are applied.

How to confirm the fix worked

Confirm the installed package or binary reports a version at or above the fixed release, then exercise replication setup and monitoring under load to verify no crash occurs and that service availability metrics remain stable.

Typical attack path

  1. Obtain high-privileged network credentials for the MySQL instance
  2. Establish a connection using any supported protocol
  3. Send crafted replication commands or packets that reach the vulnerable Server: Replication code
  4. Trigger the flaw resulting in immediate or repeatable service hang or crash

How to detect it

Search database error logs and system crash dumps for replication-component failures or abrupt terminations occurring after privileged network sessions; correlate with authentication events from high-privileged accounts.

What your security team should do

  • Apply the vendor-supplied update to all affected MySQL 8.4 and 9.7 instances within the next maintenance window
  • Review and restrict network exposure of replication ports to only trusted sources
  • Monitor availability metrics and error logs for replication-related crashes until all systems are updated

The record

Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication). Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and 9.7.0-9.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).

Affected packages

Ecosystem Package Introduced Fixed

Related vulnerabilities