CVE-2020-14828

FAUCET Score

CVE-2020-14828 is a high-severity vulnerability affecting Oracle MySQL Server versions 8.0.21 and prior, specifically within the Server: DML component. This easily exploitable flaw allows a highly privileged attacker with network access to fully compromise the MySQL Server, leading to complete loss of confidentiality, integrity, and availability. While the CVSS score is 7.2 (High), there is currently no known active exploitation, public exploit code, or significant community discussion surrounding this vulnerability. Despite its potential impact, its EPSS score is low, suggesting a low probability of exploitation in the wild.

Impacted Technologies

Vendor	Product	Version(s)	CPE
		>= 8.0.0, <= 8.0.21CPE matchmatch criteria	cpe:2.3:a:oracle:mysql::::::::
		Range not provided by sourceCPE matchmatch criteria	cpe:2.3:a:netapp:active_iq_unified_manager:-:::::vmware_vsphere::
		Range not provided by sourceCPE matchmatch criteria	cpe:2.3:a:netapp:active_iq_unified_manager:-:::::windows::
		Range not provided by sourceCPE matchmatch criteria	cpe:2.3:a:netapp:oncommand_insight:-:::::::*
		Range not provided by sourceCPE matchmatch criteria	cpe:2.3:a:netapp:oncommand_workflow_automation:-:::::::*

CVSS Data

CVSS version used by this source: 3.1

7.2HIGH

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

Exploitability Score

1.2

Impact Score

5.9

CvssVersion

3.1

Exploit Intelligence

EPSS Score

1.90%

Probability of exploitation in next 30 days

EPSS Percentile

77.5%

Percentile rank of EPSS score among Peer Group

As of 2026-07-27

Model: v2026.06.15

This CVE's current EPSS score of 0.0190 is in the 73rd percentile among its peer group of 5,537 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.3 GitHub mentions.

Media Mentions

No media coverage found for this CVE.

The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (6)

microsoftpatch availablevia msrc

Product: 19031-16820Fixed in: 8.0.26-1

microsoftpatch availablevia msrc

Product: cm1 mysql 8.0.26-1 on CBL Mariner 1.0Fixed in: 8.0.26-1

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 8Fixed in: mysql:8.0-8040020210824134700.522a0ee4

View patch

redhatpatch availablevia redhat_api

Product: Red Hat Software Collections for Red Hat Enterprise Linux 7Fixed in: rh-mysql80-mysql-0:8.0.26-1.el7

View patch

redhatpatch availablevia redhat_api

Product: Red Hat Software Collections for Red Hat Enterprise Linux 7.7 EUSFixed in: rh-mysql80-mysql-0:8.0.26-1.el7

View patch

oraclevendor investigatingvia nvd_reference

View patch

Vendor Advisories (2)

redhatCVE-2020-14828Moderate

mysql: Server: DML unspecified vulnerability (CPU Oct 2020)

Oct 20, 2020

microsoft2020-Oct/CVE-2020-14828Important

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DML). Supported versions that are affected are 8.0.21 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in takeover of MySQL Server. CVSS 3.1 Base Score 7.2 (Confidentiality Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).

Oct 13, 2020

References

security.gentoo.org / glsa/202105-27

Third Party Advisory

security.netapp.com / advisory/ntap-20201023-0003

Third Party Advisory

oracle.com / security-alerts/cpuoct2020.html

Vendor Advisory