Oracle MySQL: OpenSSL stack buffer overflow (CVE-2025-15467) patched in October 2026 update

Oracle MySQL · Critical

≈316,000internet-facing systems still vulnerableShodan estimate · 04/11/2026

CVE-2025-15467 CVE-2026-101531 CVE-2026-101679 CVE-2026-101768 CVE-2026-101769 CVE-2026-101770 CVE-2026-101771 CVE-2026-101772 CVE-2026-101773 CVE-2026-101775 CVE-2026-101781 CVE-2026-101783 CVE-2026-101785 CVE-2026-101786 CVE-2026-101796 CVE-2026-101797 CVE-2026-101810 CVE-2026-28387 CVE-2026-31790 CVE-2026-75803 CVE-2026-83404 CVE-2026-87263 CVE-2026-91241 CVE-2026-91534 CVE-2026-91535 CVE-2026-91539 CVE-2026-91545 CVE-2026-91546 CVE-2026-91549 CVE-2026-91557

Published 04/11/2026 02:45

Timeline

2 events over 14 d

21/10/2026ConfirmedCERT-FR advisories+14 d
04/11/2026 02:45Published on WatchtowerPro CISO

In short

Oracle's October 2026 update fixes a critical OpenSSL flaw (CVE-2025-15467, CVSS 9.8) that affects MySQL Server, Cluster and Enterprise Backup. Oracle released MySQL 8.4.13 and 9.7.4. It is not yet established that a normal MySQL Server can be attacked this way, and no attacks in the wild are known. Shodan estimates 316,359 internet-facing systems tagged with CVE-2025-15467 worldwide, 70,646 of them in the EU (04/11/2026). GreyNoise reports a public exploit for CVE-2025-15467 (02/11/2026).

How bad is it

Critical. An attacker who can send a crafted message to a vulnerable component may crash it or possibly run their own code, without logging in; whether a normal MySQL Server accepts such messages is not yet established.

Confirmed by the vendor or a CERT - no exploitation reported yet.

Severity score

9.1of 10Critical

The worst of 30 CVEs · CVSS 3.1 from NVD, from the vendor, read 04/11/2026.

What an attacker needs

Internet access to itEnough
A loginNot needed
A user to clickNo
Special settingsNo

Red helps the attacker, blue holds them back, grey is not published yet.

If it works, an attacker can

Read the data it holds
Change or delete that data

Type: memory corruption.

A score is the worst case for the flaw, not a verdict on any one system. How we score · ReconX customers see which of their own systems are affected.

Affected versions

MySQL Server 8.4.0-8.4.12, 9.7.0-9.7.3 and 26.7.0-26.7.1 (Oracle CPU table)
MySQL Cluster 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and 26.7.0-26.7.1 (Oracle CPU table)
MySQL Enterprise Backup 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and 26.7.0 (Oracle CPU table)
Upstream OpenSSL 3.0, 3.3, 3.4, 3.5 and 3.6 are affected; OpenSSL 1.1.1, 1.0.2 and the FIPS modules are not

Fixed in

8.4 branch: 8.4.13 (released 20/10/2026)
9.7 branch: 9.7.4

What to do now

Update MySQL to the maintenance releases Oracle announced on 21/10/2026: 8.4.13 LTS or 9.7.4 LTS. The link to this CVE in the release notes is not yet confirmed.
If MySQL runs on a Linux distribution, check the distribution's OpenSSL package: Debian bookworm 3.0.20-1~deb12u2, Ubuntu 24.04 3.0.13-0ubuntu3.7, Ubuntu 22.04 3.0.2-0ubuntu1.21 (Ubuntu 20.04 is not affected).
Interim measures only reduce exposure and do not make a server safe: do not process untrusted CMS or S/MIME content until patched.
Plan the move off MySQL 8.0, which reached end of life in April 2026.

ReconX customers see the full notice - and their own systems

Our customers are alerted at every phase. Until a patch exists, the ReconX agent watches their servers from the inside for anomalies, and our outside view - the attacker's view - shows which systems to fix first.

In ReconX: the full analysis, 5 open questions, followed up as sources answer and all 12 sources with their dates. And technology matching: which of your systems run Oracle MySQL, at which version, fixed or not - and what each one needs.

Main sources

Multiples vulnérabilités dans Oracle MySQL (21 octobre 2026) CERT · Multiples vulnérabilités dans Oracle MySQL (21 octobre 2026) CERT · NCSC-2026-0441 [1.00] [M/H] Kwetsbaarheden verholpen in Oracle MySQL CERT

← All Watchtower notices