Security readout for executives and security teams
Plain-English summary
This MySQL Server flaw can let a low-privileged network user disrupt database availability and make unauthorized changes to some accessible data. The main business risk is database outage plus limited data integrity impact, not data theft. Systems on MySQL Server 8.0.26 or earlier should be treated as high priority for update review.
Executive priority
Prioritize remediation for production or shared MySQL systems because the vulnerability can cause complete denial of service and unauthorized data modification. Urgency is high when low-privileged database access is widely issued or the service is reachable beyond tightly controlled networks.
Technical view
CVE-2021-35610 affects Oracle MySQL Server 8.0.26 and prior in the Server Optimizer component. The CVSS 3.1 score is 7.1: network exploitable, low complexity, low privileges required, no user interaction, with low integrity and high availability impact. The bundle does not identify a CWE.
Likely exposure
Exposure is likely where MySQL Server 8.0.26 or earlier accepts network connections from users with database credentials. Risk increases for broadly reachable database services, shared low-privilege accounts, or products and distributions that bundle affected MySQL packages.
Exploitation context
The source bundle says exploitation is easy and possible over multiple network protocols with low privileges. It does not show CISA KEV listing or other evidence of active exploitation. Treat exploit status as unconfirmed from the provided sources.
Researcher notes
Focus validation on version, package provenance, network reachability, and low-privileged account exposure. The sources identify impact and affected versions but do not provide exploit details, CWE classification, or active exploitation evidence. Avoid assuming confidentiality impact because the CVSS vector marks confidentiality as none.
Mitigation direction
- Apply Oracle's October 2021 CPU or a later applicable MySQL Server update.
- Follow Fedora or NetApp advisory guidance for packaged or embedded deployments.
- Restrict MySQL network access to trusted hosts and internal segments.
- Remove unnecessary low-privileged database accounts and stale credentials.
- Monitor for repeated MySQL hangs, crashes, and unexpected data changes.
Validation and detection
- Inventory MySQL Server versions and flag 8.0.26 and earlier.
- Confirm whether vendor-packaged MySQL builds include the relevant security update.
- Review database accounts that can connect over the network.
- Check logs and monitoring for recurring crashes, hangs, or abnormal writes.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2021-35610 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.1 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H2.84.2Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
7.1HighVector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H
Source materials
- CVE List V5 sourceCVE List V5
- https://www.oracle.com/security-alerts/cpuoct2021.htmlCVE reference · x_refsource_MISC
- https://security.netapp.com/advisory/ntap-20211022-0003/CVE reference · x_refsource_CONFIRM
- FEDORA-2021-70dd0b9f5dCVE reference · vendor-advisory, x_refsource_FEDORA
- FEDORA-2021-46dc82116bCVE reference · vendor-advisory, x_refsource_FEDORA
- FEDORA-2021-f74148c6d4CVE reference · vendor-advisory, x_refsource_FEDORA
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.