Multiple vulnerabilities in Oracle MySQL (August 19, 2026)

CSIRTS triage

What

Multiple vulnerabilities in Oracle MySQL allow remote code execution, denial of service, and data confidentiality breaches.

Who is affected

Deployments running affected versions of Oracle MySQL are vulnerable.

Urgency

Remediation is urgent due to the presence of remote code execution capabilities; however, specific affected versions are not detailed.

Action

Identify and upgrade to patched versions of Oracle MySQL as released by Oracle.

AI-assisted analysis generated from the source advisory — verify against the original.

Details

Source

CERT-FR Avis de sécurité (FR · national-cert · site)

Severity

unknown

Published

2026-08-19

Exploitation

Not in CISA KEV at last sync

Language

Machine-translated to English — verify against the original

Original advisory: https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-1049/

Exploitation outlook

EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.

• Low exploitation riskCVE-2026-499780.33% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 26% of all EPSS-scored CVEs.
• Low exploitation riskCVE-2025-148210.13% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 3% of all EPSS-scored CVEs.
• Low exploitation riskCVE-2026-710730.14% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 4% of all EPSS-scored CVEs.
• Low exploitation riskCVE-2026-412390.25% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 16% of all EPSS-scored CVEs.
• Low exploitation riskCVE-2026-710790.39% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 33% of all EPSS-scored CVEs.
• Low exploitation riskCVE-2026-659010.17% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 6% of all EPSS-scored CVEs.
• Low exploitation riskCVE-2026-659030.20% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 10% of all EPSS-scored CVEs.
• Low exploitation riskCVE-2026-659000.18% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 8% of all EPSS-scored CVEs.
• Low exploitation riskCVE-2026-605920.38% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 32% of all EPSS-scored CVEs.
• Low exploitation riskCVE-2026-707240.31% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 24% of all EPSS-scored CVEs.

Referenced CVEs

Same CVEs, other sources

How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.

• unknownNCSC-2026-0315 [1.00] [M/H] Vulnerabilities resolved in Oracle MySQLncsc-nl
• high[NEW] [high] IBM App Connect Enterprise: Multiple vulnerabilitiescert-bund
• unknownNCSC-2026-0312 [1.00] [M/H] Vulnerabilities resolved in Oracle Financial Servicesncsc-nl
• unknownNCSC-2026-0311 [1.00] [M/H] Vulnerabilities resolved in Oracle Enterprise Managerncsc-nl
• unknownNCSC-2026-0309 [1.00] [M/H] Vulnerabilities resolved in Oracle Communicationsncsc-nl
• high[NEW] [HIGH] Oracle Communications: Multiple Vulnerabilitiescert-bund
• high[NEW] [high] Oracle Enterprise Manager: Multiple vulnerabilitiescert-bund
• high[NEW] [high] Oracle Financial Services Applications: Multiple vulnerabilitiescert-bund
• high[NEW] [high] Oracle Hyperion: Multiple vulnerabilitiescert-bund
• high[NEW] [high] Oracle MySQL: Multiple vulnerabilitiescert-bund
• high[NEW] [high] Oracle Supply Chain: Multiple vulnerabilitiescert-bund
• medium[NEW] [medium] Oracle Retail Applications: Vulnerability compromises integritycert-bund

Recent advisories for Oracle MySQL

A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.

• unknownNCSC-2026-0315 [1.00] [M/H] Vulnerabilities resolved in Oracle MySQLncsc-nl · 2026-08-19
• high[NEW] [high] Oracle MySQL: Multiple vulnerabilitiescert-bund · 2026-08-19
• high[NEW] [high] Oracle MySQL: Multiple vulnerabilitiescert-bund · 2026-08-19
• mediumCVE-2026-71084: Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/ODBC). The…nvd · 2026-08-18
• mediumCVE-2026-71079: Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/ODBC). The…nvd · 2026-08-18
• mediumCVE-2026-71073: Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/ODBC). The…nvd · 2026-08-18

More from CERT-FR Avis de sécurité

• unknownMultiple vulnerabilities in Oracle Weblogic (August 19, 2026)2026-08-19
• unknownMultiple vulnerabilities in Axis products (August 19, 2026)2026-08-19
• unknownMultiple vulnerabilities in Google Chrome (August 19, 2026)2026-08-19
• unknownMultiple vulnerabilities in Oracle Java SE (August 19, 2026)2026-08-19
• unknownMultiple vulnerabilities in Oracle Virtualization (August 19, 2026)2026-08-19