Vulnerability record · CVE-2021-35594 · published 20 October 2021
CVE-2021-35594: Oracle MySQL Cluster flaw allows takeover via adjacent network
Oracle · Mysql Cluster
CVE-2021-35594 is a difficult-to-exploit vulnerability in the Cluster: General component of Oracle MySQL Cluster affecting versions 7.4.33, 7.5.23, 7.6.19 and 8.0.26 and prior. It is reachable only from the physical communication segment attached to the MySQL Cluster hardware and requires human interaction from someone other than the attacker. A successful attack can fully take over MySQL Cluster, affecting confidentiality, integrity and availability.
Description
Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General). Supported versions that are affected are 7.4.33 and prior, 7.5.23 and prior, 7.6.19 and prior and 8.0.26 and prior. Difficult to exploit vulnerability allows high privileged attacker with access to the physical communication segment attached to the hardware where the MySQL Cluster executes to compromise MySQL Cluster. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of MySQL Cluster. CVSS 3.1 Base Score 6.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H).
CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H
Automated analysis
medium priorityCVSS 6.3 with high privileges, adjacent access and required user interaction limits practical exploitation, though EPSS is high and impact is full takeover.
What it is
CVE-2021-35594 is a difficult-to-exploit vulnerability in the Cluster: General component of Oracle MySQL Cluster affecting versions 7.4.33, 7.5.23, 7.6.19 and 8.0.26 and prior. It is reachable only from the physical communication segment attached to the MySQL Cluster hardware and requires human interaction from someone other than the attacker. A successful attack can fully take over MySQL Cluster, affecting confidentiality, integrity and availability.
Impact
An attacker who can reach the cluster's communication segment and induce user interaction gains complete takeover of MySQL Cluster, with high confidentiality, integrity and availability impact.
Attack surface
The vector is adjacent (AV:A), so the attacker must be on the same physical communication segment as the MySQL Cluster hardware. Exploitation requires high privileges (PR:H) and human interaction from a person other than the attacker (UI:R), making it a narrow, difficult-to-reach path.
Exploitation
Not listed in CISA KEV and no ransomware groups are documented using it. EPSS is 0.51136 (98.9th percentile), indicating elevated predicted exploitation activity, but the record contains no public exploit or in-the-wild confirmation.
What to do
- Apply the Oracle October 2021 CPU patch for MySQL Cluster (7.4.33, 7.5.23, 7.6.19, 8.0.26 and prior affected).
- Apply NetApp advisories for OnCommand Insight and SnapCenter where those products bundle the affected component.
- Segment and restrict access to the MySQL Cluster physical communication segment to trusted, high-privilege hosts only.
- Enforce least privilege on cluster administration accounts and monitor for unexpected interactive actions.
- Review whether MySQL Cluster is exposed on shared or untrusted network segments and isolate it where possible.
Detection
- Monitor MySQL Cluster logs for unexpected administrative or configuration changes originating from adjacent hosts.
- Alert on anomalous interactive sessions or privilege use on cluster nodes from non-standard sources.
- Track patch state of MySQL Cluster, OnCommand Insight and SnapCenter against the October 2021 CPU baseline.
- Watch network traffic on the cluster communication segment for unusual peer connections or protocol anomalies.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
3 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
| Link | Tags |
|---|---|
| https://security.netapp.com/advisory/ntap-20211022-0003/ | Third Party Advisory |
| https://www.oracle.com/security-alerts/cpuoct2021.html | PatchVendor Advisory |
| https://www.zerodayinitiative.com/advisories/ZDI-21-1227/ | Third Party AdvisoryVDB Entry |
| https://security.netapp.com/advisory/ntap-20211022-0003/ | Third Party Advisory |
| https://www.oracle.com/security-alerts/cpuoct2021.html | PatchVendor Advisory |
| https://www.zerodayinitiative.com/advisories/ZDI-21-1227/ | Third Party AdvisoryVDB Entry |
Track CVE-2021-35594 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2021-35594), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
