Vulnerability record · CVE-2022-21550 · published 19 July 2022
CVE-2022-21550: Oracle MySQL Cluster general component flaw allows takeover
Oracle · Mysql Cluster
A vulnerability in the Cluster: General component of Oracle MySQL Cluster affects versions 7.4.36 and prior, 7.5.26 and prior, 7.6.22 and prior, and 8.0.29 and prior. The flaw is difficult to exploit and requires a high-privileged attacker with access to the physical communication segment, plus human interaction from another person, but successful exploitation can result in full takeover of MySQL Cluster.
Description
Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General). Supported versions that are affected are 7.4.36 and prior, 7.5.26 and prior, 7.6.22 and prior and and 8.0.29 and prior. Difficult to exploit vulnerability allows high privileged attacker with access to the physical communication segment attached to the hardware where the MySQL Cluster executes to compromise MySQL Cluster. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of MySQL Cluster. CVSS 3.1 Base Score 6.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H).
CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H
Automated analysis
medium priorityCVSS 6.3 and difficult exploitation with high privileges and user interaction reduce urgency, but EPSS is high and takeover impact is severe, so patching remains important.
What it is
A vulnerability in the Cluster: General component of Oracle MySQL Cluster affects versions 7.4.36 and prior, 7.5.26 and prior, 7.6.22 and prior, and 8.0.29 and prior. The flaw is difficult to exploit and requires a high-privileged attacker with access to the physical communication segment, plus human interaction from another person, but successful exploitation can result in full takeover of MySQL Cluster.
Impact
An attacker who meets the access and interaction requirements can compromise confidentiality, integrity, and availability of MySQL Cluster, effectively taking it over. The CVSS 3.1 base score is 6.3 (Medium).
Attack surface
The attack is adjacent (AV:A), requiring access to the physical communication segment attached to the MySQL Cluster hardware. It requires high privileges (PR:H) and human interaction from a person other than the attacker (UI:R).
Exploitation
CISA KEV does not list this CVE, and no ransomware groups are documented using it. EPSS shows a 30-day probability of 0.50698 (98.865th percentile), indicating high predicted likelihood, but the references only carry Patch, Vendor Advisory, and Third Party Advisory tags, with no public exploit tag.
What to do
- Apply the Oracle July 2022 Critical Patch Update for MySQL Cluster and the corresponding NetApp advisories for affected products.
- Restrict network access to the physical communication segment used by MySQL Cluster to trusted, high-privileged hosts only.
- Enforce least privilege so that high-privileged accounts are limited and monitored.
- Require user interaction safeguards and awareness for operators with access to the cluster segment.
- Monitor for unusual cluster takeover activity and validate integrity of MySQL Cluster components after patching.
Detection
- Monitor MySQL Cluster logs for unexpected takeover or privilege escalation events.
- Alert on anomalous access to the physical communication segment from high-privileged accounts.
- Track patch status of MySQL Cluster versions 7.4.36, 7.5.26, 7.6.22, 8.0.29 and earlier across managed assets.
- Correlate user interaction events with cluster administration actions for signs of social engineering.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
5 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
| Link | Tags |
|---|---|
| https://security.netapp.com/advisory/ntap-20220729-0004/ | Third Party Advisory |
| https://www.oracle.com/security-alerts/cpujul2022.html | PatchVendor Advisory |
| https://security.netapp.com/advisory/ntap-20220729-0004/ | Third Party Advisory |
| https://www.oracle.com/security-alerts/cpujul2022.html | PatchVendor Advisory |
Track CVE-2022-21550 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2022-21550), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.
