CVE-2021-35590: Oracle MySQL Cluster out-of-bounds write allows takeover

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

medium priorityCVSS 6.3 with high EPSS but exploitation requires adjacent access, high privileges and user interaction, and there is no KEV listing or confirmed in-the-wild activity.

What it is

MySQL Cluster contains an out-of-bounds write (CWE-787) in the Cluster: General component. Oracle rates it difficult to exploit, but a successful attack can fully compromise the cluster. Affected versions are 7.4.33 and prior, 7.5.23 and prior, 7.6.19 and prior, and 8.0.26 and prior.

Impact

An attacker who succeeds gains full takeover of MySQL Cluster, with high confidentiality, integrity and availability impact. The CVSS 3.1 base score is 6.3 (Medium).

Attack surface

The vector is adjacent network (AV:A), so the attacker must be on the physical communication segment attached to the MySQL Cluster hardware. Exploitation requires high privileges (PR:H) and human interaction from a person other than the attacker (UI:R).

Exploitation

Not listed in CISA KEV and no ransomware usage is documented. EPSS is high (0.88497, 99.764th percentile), but the record contains no public exploit or in-the-wild confirmation, so this is a probability estimate only.

What to do

• Apply the Oracle October 2021 CPU patch for MySQL Cluster; upgrade to a version above 7.4.33, 7.5.23, 7.6.19 or 8.0.26 as applicable.
• Apply the NetApp advisory fixes for OnCommand Insight and SnapCenter if those products are in use.
• Restrict network access to the MySQL Cluster communication segment so only trusted, high-privilege hosts can reach it.
• Reduce the number of accounts with the high privileges required to trigger the flaw and monitor their use.
• Treat any user interaction on cluster hosts as a risk vector and limit who can operate on those systems.

Detection

• Monitor MySQL Cluster logs for crashes, restarts or abnormal termination that could indicate memory corruption.
• Alert on unexpected connections to the cluster communication segment from hosts outside the approved node list.
• Track use of high-privilege cluster accounts and flag activity outside normal maintenance windows.
• Watch for post-exploitation changes to cluster configuration or data integrity on affected nodes.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.