CVE-2026-70724: 
MySQL Cluster vulnerability analysis and mitigation

CVE-2026-70724 is a vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General) that can result in complete takeover of the affected cluster. It was disclosed and patched on August 18, 2026, as part of Oracle's Critical Security Patch Update (CSPU). Affected versions include MySQL Cluster 8.0.0–8.0.48, 8.4.0–8.4.11, and 9.7.0–9.7.2. It carries a CVSS v3.1 base score of 7.5 (High) (Oracle Advisory, Feedly).

The vulnerability resides in the Cluster: General component of Oracle MySQL Cluster and is exploitable remotely over HTTP by an unauthenticated attacker. Exploitation is classified as "difficult" (high attack complexity) and requires human interaction from a party other than the attacker, suggesting a social engineering or user-interaction-dependent attack vector. No specific CWE classification has been assigned by NVD at this time, and Oracle has not publicly disclosed the precise root cause or technical mechanism. No public proof-of-concept or detailed technical write-up is currently available (Oracle Advisory).

Successful exploitation can result in complete takeover of the MySQL Cluster instance, with high impacts to confidentiality, integrity, and availability. An attacker could gain unauthorized access to all data stored in the cluster, modify or destroy data, and disrupt cluster availability. Given the central role MySQL Cluster often plays in database infrastructure, compromise could facilitate lateral movement or broader infrastructure access (Oracle Advisory, Feedly).

As of the disclosure date, there is no public proof-of-concept exploit and no evidence of active in-the-wild exploitation (Feedly). The EPSS score is reported as 0.0, indicating a currently low probability of exploitation in the near term. The vulnerability has not been added to the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported.

Oracle has released patches for all affected versions as part of the August 18, 2026 Critical Security Patch Update. Organizations should upgrade MySQL Cluster to versions beyond 8.0.48, 8.4.11, and 9.7.2 respectively. As a temporary measure, Oracle recommends restricting network access to MySQL Cluster management interfaces to trusted hosts only and implementing network segmentation to limit HTTP exposure. Oracle strongly advises against relying on network-blocking workarounds as a long-term solution (Oracle Advisory).