CVE-2026-71084 Overview
CVE-2026-71084 is a local vulnerability in the Oracle MySQL Connectors product, specifically the Connector/ODBC component. The affected version is 26.7.0. An unauthenticated attacker with local access to the infrastructure where MySQL Connectors executes can exploit this flaw. Successful exploitation causes a hang or repeatable crash of MySQL Connectors and grants unauthorized read access to a subset of accessible data. The weakness maps to [CWE-284: Improper Access Control].
Critical Impact
Local attackers can trigger a complete denial of service against MySQL Connector/ODBC and read a subset of connector-accessible data without authentication.
Affected Products
- Oracle MySQL Connectors 26.7.0
- MySQL Connector/ODBC component
- Deployments where the connector executes on shared infrastructure
Discovery Timeline
- 2026-08-18 - CVE-2026-71084 published to NVD
- 2026-08-20 - Last updated in NVD database
Technical Details for CVE-2026-71084
Vulnerability Analysis
The vulnerability resides in the Connector/ODBC component of Oracle MySQL Connectors 26.7.0. Connector/ODBC provides Open Database Connectivity drivers that allow applications to interact with MySQL databases. An attacker with local logon to the infrastructure hosting the connector can trigger conditions that hang or repeatedly crash the driver. The same attack path also exposes a subset of data accessible to the connector process.
The scope remains unchanged, meaning the attack impact is confined to the connector itself. However, the availability impact is high because exploitation produces a complete denial of service. Confidentiality impact is limited to partial disclosure of connector-accessible data. Integrity is not affected.
Root Cause
The underlying weakness is classified as improper access control [CWE-284]. Oracle's advisory does not publish the specific code path or function responsible for the flaw. The connector fails to properly restrict access to internal resources or state, allowing a local user without credentials to interact with the driver in ways that provoke a crash and expose data.
Attack Vector
The attack vector is local (AV:L), requiring the attacker to have logon access to the host executing the connector. No authentication or user interaction is required. Attack complexity is low, meaning exploitation does not depend on specialized conditions. The EPSS score is 0.148%, indicating low observed exploitation probability at the time of publication.
Refer to the Oracle Security Alert for vendor guidance and version-specific fix availability.
Detection Methods for CVE-2026-71084
Indicators of Compromise
- Unexpected termination or repeated crash events of processes loading MySQL Connector/ODBC libraries
- Application logs showing ODBC driver hangs, timeouts, or abnormal reconnection loops
- Local user sessions interacting with connector processes outside normal application workflows
Detection Strategies
- Monitor for repeated crash signatures of applications using Connector/ODBC on hosts running version 26.7.0
- Correlate local logon events with subsequent connector service disruptions
- Audit file and process access to ODBC driver components by non-application user accounts
Monitoring Recommendations
- Enable process telemetry on hosts where MySQL Connector/ODBC is installed to capture crash and restart patterns
- Track Windows Event Log or Linux syslog entries referencing ODBC driver faults
- Baseline expected connector activity and alert on deviations, including hangs exceeding normal query timeouts
How to Mitigate CVE-2026-71084
Immediate Actions Required
- Inventory all systems running Oracle MySQL Connectors 26.7.0 with the Connector/ODBC component
- Apply the fix referenced in the Oracle Critical Patch Update as soon as it is available for your platform
- Restrict local logon rights on hosts where the connector executes to reduce the pool of potential attackers
Patch Information
Oracle addresses this issue through its Critical Patch Update process. Consult the Oracle Security Alert for August 2026 for the specific patch, download location, and any prerequisite updates for Connector/ODBC 26.7.0.
Workarounds
- Limit interactive and remote local logon to connector hosts using operating system access controls
- Run applications that load Connector/ODBC under least-privilege service accounts isolated from general users
- Segment database middleware hosts from general-purpose workstations to reduce local attack surface
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
