CVE-2025-21540: Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Security: Privileges). Supported versions that are affected are 8.0.40 and prior, 8.4.3 and prior and 9.1.0 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of MySQL Server accessible data as well

CSIRTS triage

vendor: Oracle product: MySQL Server Privilege escalationaffected: 8.0.40 and prior, 8.4.3 and prior, 9.1.0 and prior

What: A privilege escalation vulnerability in the Security: Privileges component allows a low-privileged attacker to elevate privileges via network access.
Who is affected: MySQL Server deployments running 8.0.40 or earlier, 8.4.3 or earlier, or 9.1.0 or earlier, exposed to network access.
Urgency: Medium priority; CVSS 5.4 and easily exploitable by low-privileged attackers, but not currently exploited.
Action: Upgrade MySQL Server to a patched version beyond 8.0.40, 8.4.3, or 9.1.0 as provided by Oracle.

AI-assisted analysis generated from the source advisory — verify against the original.

⚡ Watch MySQL Server

Get an email when a new MySQL Server advisory drops — max one per day, one-click unsubscribe.

EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.

Low exploitation riskCVE-2025-215400.50% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 41% of all EPSS-scored CVEs.

CVE	CSIRTS overview	External
CVE-2025-21540	coverage & exploitation status	NVD · CVE.org