ORACLE’S October 2026 Critical Patch Update fixes 98 vulnerabilities across MySQL products. The two highest-rated flaws, both scored CVSS 9.8, are in third-party libraries bundled with MySQL: CVE-2025-15467 in OpenSSL and CVE-2026-9547 in curl. The article says both can be reached remotely without authentication and could lead to a system takeover. CVE-2025-15467 affects the OpenSSL library in MySQL Server and MySQL Enterprise Backup; its patch also includes 29 related CVEs. The curl update covers more than 30 additional curl CVEs. The article reports no confirmed exploitation.
Among vulnerabilities in MySQL’s own code, CVE-2026-101781 is rated CVSS 8.8 and affects Group Replication; exploiting it requires the attacker to be on the same network segment as the server. Other listed flaws affect client programs and Connector/J. Overall, 75 of the 98 fixes are rated medium severity, 45 require high privileges, and about two thirds can cause the server to crash or hang. InnoDB and the Optimizer received the largest numbers of fixes, with 18 and 14 respectively.
Oracle’s affected-version ranges include MySQL Server 8.4.0–8.4.12, 9.7.0–9.7.3 and 26.7.0–26.7.1, with separate affected ranges for Cluster, Enterprise Backup, Router and Connectors. The article advises upgrading the affected products to fixed releases listed in Oracle’s October advisory. It also recommends keeping MySQL and Router ports off the public internet, restricting high-privilege database accounts and isolating Group Replication traffic.