CVE-2021-27928

56

FAUCET Score

CVE-2021-27928 is a high-severity remote code execution vulnerability affecting MariaDB (versions 10.2, 10.3, 10.4, 10.5), Percona Server, and MySQL with the wsrep patch. A database SUPER user can exploit an untrusted search path and eval injection by modifying wsrep_provider and wsrep_notify_cmd to execute arbitrary OS commands. This vulnerability has a CVSS score of 7.2 (High) due to its network-based attack vector, low attack complexity, and high impact on confidentiality, integrity, and availability. While not currently on the CISA KEV catalog, a public exploit (EDB-49765) exists, and there is some community discussion, indicating potential for future exploitation.

Impacted Technologies

Vendor	Product	Version(s)	CPE
		>= 10.2, < 10.2.37CPE matchmatch criteria	cpe:2.3:a:mariadb:mariadb::::::::
		>= 10.3, < 10.3.28CPE matchmatch criteria	cpe:2.3:a:mariadb:mariadb::::::::
		>= 10.4, < 10.4.18CPE matchmatch criteria	cpe:2.3:a:mariadb:mariadb::::::::
		>= 10.5, < 10.5.9CPE matchmatch criteria	cpe:2.3:a:mariadb:mariadb::::::::
		<= 2021-03-03CPE matchmatch criteria	cpe:2.3:a:percona:percona_server::::::::

CVSS Data

CVSS version used by this source: 3.1

7.2HIGH

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

Exploitability Score

1.2

Impact Score

5.9

CvssVersion

3.1

Exploit Intelligence

EPSS Score

38.18%

Probability of exploitation in next 30 days

EPSS Percentile

98.4%

Percentile rank of EPSS score among Peer Group

As of 2026-07-27

Model: v2026.06.15

ExploitDB: EDB-49765 · Apr 14, 2021

This CVE's current EPSS score of 0.3818 is in the 97th percentile among its peer group of 5,537 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.3 GitHub mentions.

Media Mentions

No media coverage found for this CVE.

The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (38)

microsoftpatch availablevia msrc

Product: 13590-12137Fixed in: 10.3.28-1

microsoftpatch availablevia msrc

Product: 13591-12137Fixed in: 10.3.28-1

microsoftpatch availablevia msrc

Product: 13592-12137Fixed in: 10.3.28-1

microsoftpatch availablevia msrc

Product: 13593-12137Fixed in: 10.3.28-1

microsoftpatch availablevia msrc

Product: 13594-12137Fixed in: 10.3.28-1

microsoftpatch availablevia msrc

Product: 13595-12137Fixed in: 10.3.28-1

microsoftpatch availablevia msrc

Product: 13596-12138Fixed in: 10.3.28-1

microsoftpatch availablevia msrc

Product: 13597-12138Fixed in: 10.3.28-1

microsoftpatch availablevia msrc

Product: 13598-12138Fixed in: 10.3.28-1

microsoftpatch availablevia msrc

Product: 13599-12138Fixed in: 10.3.28-1

microsoftpatch availablevia msrc

Product: 13600-12138Fixed in: 10.3.28-1

microsoftpatch availablevia msrc

Product: 13601-12138Fixed in: 10.3.28-1

microsoftpatch availablevia msrc

Product: mariadb-10.3.28-1.cm1.x86_64.rpm on CBL Mariner 1.0 x64Fixed in: 10.3.28-1

microsoftpatch availablevia msrc

Product: mariadb-server-10.3.28-1.cm1.x86_64.rpm on CBL Mariner 1.0 x64Fixed in: 10.3.28-1

microsoftpatch availablevia msrc

Product: mariadb-server-galera-10.3.28-1.cm1.x86_64.rpm on CBL Mariner 1.0 x64Fixed in: 10.3.28-1

microsoftpatch availablevia msrc

Product: mariadb-devel-10.3.28-1.cm1.x86_64.rpm on CBL Mariner 1.0 x64Fixed in: 10.3.28-1

microsoftpatch availablevia msrc

Product: mariadb-errmsg-10.3.28-1.cm1.x86_64.rpm on CBL Mariner 1.0 x64Fixed in: 10.3.28-1

microsoftpatch availablevia msrc

Product: mariadb-debuginfo-10.3.28-1.cm1.x86_64.rpm on CBL Mariner 1.0 x64Fixed in: 10.3.28-1

microsoftpatch availablevia msrc

Product: mariadb-10.3.28-1.cm1.aarch64.rpm on CBL Mariner 1.0 ARMFixed in: 10.3.28-1

microsoftpatch availablevia msrc

Product: mariadb-server-10.3.28-1.cm1.aarch64.rpm on CBL Mariner 1.0 ARMFixed in: 10.3.28-1

microsoftpatch availablevia msrc

Product: mariadb-server-galera-10.3.28-1.cm1.aarch64.rpm on CBL Mariner 1.0 ARMFixed in: 10.3.28-1

microsoftpatch availablevia msrc

Product: mariadb-devel-10.3.28-1.cm1.aarch64.rpm on CBL Mariner 1.0 ARMFixed in: 10.3.28-1

microsoftpatch availablevia msrc

Product: mariadb-errmsg-10.3.28-1.cm1.aarch64.rpm on CBL Mariner 1.0 ARMFixed in: 10.3.28-1

microsoftpatch availablevia msrc

Product: mariadb-debuginfo-10.3.28-1.cm1.aarch64.rpm on CBL Mariner 1.0 ARMFixed in: 10.3.28-1

redhatpatch availablevia redhat_api

Product: Red Hat Software Collections for Red Hat Enterprise Linux 7.7 EUSFixed in: rh-mariadb103-galera-0:25.3.32-2.el7

redhatpatch availablevia redhat_api

Product: Red Hat Software Collections for Red Hat Enterprise Linux 7.7 EUSFixed in: rh-mariadb103-mariadb-3:10.3.28-2.el7

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 8Fixed in: mariadb:10.3-8030020210324132345.229f0a1c

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 8Fixed in: mariadb-devel:10.3-8030020210324132345.229f0a1c

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 8.1 Extended Update SupportFixed in: mariadb:10.3-8010020210324132606.c27ad7f8

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 8.1 Extended Update SupportFixed in: mariadb-devel:10.3-8010020210324132606.c27ad7f8

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 8.2 Extended Update SupportFixed in: mariadb:10.3-8020020210324132420.4cda2c84

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 8.2 Extended Update SupportFixed in: mariadb-devel:10.3-8020020210324132420.4cda2c84

redhatpatch availablevia redhat_api

Product: Red Hat OpenStack Platform 13.0 (Queens)Fixed in: mariadb-3:10.1.20-3.el7ost

redhatpatch availablevia redhat_api

Product: Red Hat OpenStack Platform 13.0 (Queens) for RHEL 7.6 EUSFixed in: mariadb-3:10.1.20-3.el7ost

redhatpatch availablevia redhat_api

Product: Red Hat Software Collections for Red Hat Enterprise Linux 7Fixed in: rh-mariadb103-galera-0:25.3.32-2.el7

redhatpatch availablevia redhat_api

Product: Red Hat Software Collections for Red Hat Enterprise Linux 7Fixed in: rh-mariadb103-mariadb-3:10.3.28-2.el7

redhatpatch availablevia redhat_api

Product: Red Hat Software Collections for Red Hat Enterprise Linux 7.6 EUSFixed in: rh-mariadb103-galera-0:25.3.32-2.el7

redhatpatch availablevia redhat_api

Product: Red Hat Software Collections for Red Hat Enterprise Linux 7.6 EUSFixed in: rh-mariadb103-mariadb-3:10.3.28-2.el7

Vendor Advisories (2)

redhatCVE-2021-27928Important

mariadb: writable system variables allows a database user with SUPER privilege to execute arbitrary code as the system mysql user

microsoft2021-Mar/CVE-2021-27928

A remote code execution issue was discovered in MariaDB 10.2 before 10.2.37 10.3 before 10.3.28 10.4 before 10.4.18 and 10.5 before 10.5.9; Percona Server through 2021-03-03; and the wsrep patch through 2021-03-03 for MySQL. An untrusted search path leads to eval injection in which a database SUPER user can execute OS commands after modifying wsrep_provider and wsrep_notify_cmd. NOTE: this does not affect an Oracle product.

References

packetstormsecurity.com / files/162177/MariaDB-10.2-Command-Execution.html

ExploitThird Party AdvisoryVDB Entry

jira.mariadb.org / browse/MDEV-25179

Issue TrackingVendor Advisory

lists.debian.org / debian-lts-announce/2021/03/msg00028.html

Mailing ListThird Party Advisory

mariadb.com / kb/en/mariadb-10237-release-notes

Release NotesVendor Advisory

mariadb.com / kb/en/mariadb-10328-release-notes

Release NotesVendor Advisory

mariadb.com / kb/en/mariadb-10418-release-notes

Release NotesVendor Advisory

mariadb.com / kb/en/mariadb-1059-release-notes

Release NotesVendor Advisory

mariadb.com / kb/en/security

Vendor Advisory

security.gentoo.org / glsa/202105-28

Third Party Advisory