CVE-2026-61109

High [CVE-2026-46936 +28] July 2026 MySQL Server 8.4.0 and 9.7.0 Vulnerabilities in NetApp Products

NTAP-20260731-0017Source published Jul 31, 2026Source updated Oct 5, 2026

This bulletin covers 29 CVEs. The products, versions, score and guidance below describe the bulletin; check its source for applicability to this specific CVE.

MySQL Server versions 8.4.0 through 8.4.10 and 9.7.0 through 9.7.1 are susceptible to vulnerabilities that allow unauthenticated, high and low privileged attackers with network access via multiple protocols to compromise MySQL Server and unauthenticated and high privileged attackers with logon to the infrastructure where MySQL Server executes to compromise MySQL Server. Refer to “Oracle Critical Patch Update Advisory - July 2026” for additional details. Successful attacks of these vulnerabilities can result in unauthorized read access to a subset of MySQL Server accessible data, or unauthorized update, insert or delete access to some of MySQL Server accessible data, unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) or partial denial of service (partial…

Affected products in this advisory

• Active IQ Unified Manager for Microsoft Windows
• Active IQ Unified Manager for VMware vSphere
• SnapCenter

Source-reported affected versions

• 8.4.0
• 8.4.10
• 9.7.0
• 9.7.1

Source-reported fixed versions

No fixed-version detail extracted. This does not mean no fix exists.

Mitigation guidance

• Refer to “Oracle Critical Patch Update Advisory - July 2026” for additional details.
• Successful attacks of these vulnerabilities can result in unauthorized read access to a subset of MySQL Server accessible data, or unauthorized update, insert or delete access to some of MySQL Server accessible data, unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) or partial denial of service (partial DOS) of MySQL Server, or a takeover of MySQL Server.

Workarounds

• Full Support versions of SnapCenter Server allow MySQL software to be upgraded within documented constraints. Consult the product documentation for supported MySQL versions and other information related to the upgrade. <br><br> In Full Support versions of OnCommand Insight the MySQL software can be upgraded after acquiring updated OnCommand Insight binaries via technical support.

Medium [CVE-2026-61109] JSON unspecified vulnerability (CPU Jul 2026)

CVE-2026-61109Source published Jul 21, 2026Source updated Jul 21, 2026

Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: JSON). Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and 9.7.0-9.7.1. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 6.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). Red Hat Product Security rates the severity of this flaw as determined by the Oracle MySQL Critical Patch Update. Red Hat…

Affected products in this advisory

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 8
• Red Hat Enterprise Linux 9
• Red Hat package: mysql8.4

Source-reported affected versions

• 8.4.0-8
• 4.10
• 9.7.0-9

Source-reported fixed versions

• mysql8.4-0:8.4.11-1.el10_2
• mysql:8.4-8100020260812072430.489197e6
• mysql:8.4-9080020260812072812.rhel9
• RHSA-2026:56007

2 more entries in the full advisory.

Mitigation guidance

No mitigation guidance extracted; consult the source.