Vulnerability record · CVE-2021-35598 · published 20 October 2021
CVE-2021-35598: Oracle MySQL Cluster general component flaw allows takeover
Oracle · Mysql Cluster
Oracle MySQL Cluster contains a vulnerability in the Cluster: General component affecting versions 7.4.33 and prior, 7.5.23 and prior, 7.6.19 and prior, and 8.0.26 and prior. It is difficult to exploit and requires a high-privileged attacker with access to the physical communication segment plus human interaction by another person, but a successful attack can result in takeover of MySQL Cluster.
Description
Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General). Supported versions that are affected are 7.4.33 and prior, 7.5.23 and prior, 7.6.19 and prior and 8.0.26 and prior. Difficult to exploit vulnerability allows high privileged attacker with access to the physical communication segment attached to the hardware where the MySQL Cluster executes to compromise MySQL Cluster. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of MySQL Cluster. CVSS 3.1 Base Score 6.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H).
CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H
Automated analysis
medium priorityCVSS 6.3 with high EPSS but exploitation requires adjacent access, high privileges and user interaction, and no KEV or public exploit is documented.
What it is
Oracle MySQL Cluster contains a vulnerability in the Cluster: General component affecting versions 7.4.33 and prior, 7.5.23 and prior, 7.6.19 and prior, and 8.0.26 and prior. It is difficult to exploit and requires a high-privileged attacker with access to the physical communication segment plus human interaction by another person, but a successful attack can result in takeover of MySQL Cluster.
Impact
An attacker who succeeds gains full compromise of the MySQL Cluster, affecting confidentiality, integrity and availability. The result is takeover of the cluster rather than limited data exposure.
Attack surface
The vector is adjacent (AV:A), so the attacker must be on the same physical communication segment as the MySQL Cluster hardware. Exploitation requires high privileges (PR:H) and human interaction from a person other than the attacker (UI:R), making it a narrow, non-remote path.
Exploitation
Not listed in CISA KEV and no ransomware association is documented. EPSS is 0.51136 (98.9th percentile), indicating elevated modeled likelihood, but the references only carry patch, vendor advisory and third-party advisory tags with no public exploit noted.
What to do
- Apply the Oracle October 2021 CPU patch for MySQL Cluster and the referenced NetApp advisories for affected products.
- Restrict network and physical access to the cluster communication segment to trusted, high-privileged administrators only.
- Enforce least privilege on MySQL Cluster accounts and remove unnecessary high-privilege access.
- Monitor and control human interaction paths (operator actions, maintenance workflows) that the attack requires.
- Track vendor advisories for updated fixes covering the listed version ranges.
Detection
- Monitor MySQL Cluster logs for unexpected administrative or configuration changes on cluster nodes.
- Alert on anomalous activity from hosts on the cluster communication segment, especially high-privilege sessions.
- Baseline and review operator actions that could satisfy the required human interaction step.
- Correlate cluster node integrity or availability changes with nearby privileged access events.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
3 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
| Link | Tags |
|---|---|
| https://security.netapp.com/advisory/ntap-20211022-0003/ | Third Party Advisory |
| https://www.oracle.com/security-alerts/cpuoct2021.html | PatchVendor Advisory |
| https://www.zerodayinitiative.com/advisories/ZDI-21-1230/ | Third Party AdvisoryVDB Entry |
| https://security.netapp.com/advisory/ntap-20211022-0003/ | Third Party Advisory |
| https://www.oracle.com/security-alerts/cpuoct2021.html | PatchVendor Advisory |
| https://www.zerodayinitiative.com/advisories/ZDI-21-1230/ | Third Party AdvisoryVDB Entry |
Track CVE-2021-35598 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2021-35598), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.
