CVE-2021-35592: Oracle MySQL Cluster flaw allows takeover via adjacent network

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: medium.

medium priorityCVSS 6.3 and the need for adjacent access, high privileges, and user interaction limit practical exploitation, though the impact is full cluster takeover and EPSS is elevated.

What it is

CVE-2021-35592 is a vulnerability in the Cluster: General component of Oracle MySQL Cluster affecting versions 7.5.23 and prior, 7.6.19 and prior, and 8.0.26 and prior. It is a difficult-to-exploit issue mapped to CWE-129 (improper validation of array index) that can lead to full takeover of MySQL Cluster. The record does not describe the specific root cause beyond the CWE mapping.

Impact

A successful attack can result in complete compromise of MySQL Cluster, affecting confidentiality, integrity, and availability. The attacker gains takeover of the cluster rather than a limited read or denial of service.

Attack surface

The CVSS vector (AV:A/PR:H/UI:R) indicates the attacker must already be on the adjacent network segment and hold high privileges, and a separate user must perform some action. It is not remotely exploitable over the internet and does not work without that human interaction.

Exploitation

No exploitation is confirmed: the CVE is not in CISA KEV and no ransomware groups are documented using it. EPSS is high at 0.52491 (98.9th percentile), but the reference tags only show vendor and third-party advisories, not exploit code.

What to do

• Apply the Oracle October 2021 Critical Patch Update for MySQL Cluster (7.5.24, 7.6.20, 8.0.27 or later as applicable).
• Apply the NetApp advisory updates for OnCommand Insight and SnapCenter where those products bundle affected MySQL Cluster components.
• Restrict network access to the MySQL Cluster communication segment so only trusted, authorized hosts can reach it.
• Limit high-privilege accounts on MySQL Cluster and review who holds them.
• Monitor for unusual cluster node behavior or configuration changes that could indicate tampering.

Detection

• Audit MySQL Cluster nodes for unexpected configuration or data changes and correlate with privileged account activity.
• Monitor the cluster communication segment for anomalous traffic from unauthorized hosts.
• Track authentication and privilege-use events for high-privilege MySQL Cluster accounts.
• Verify installed MySQL Cluster versions against the affected ranges during vulnerability scans.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.