CVE-2026-22015

CVE-2026-22015 is a confidentiality vulnerability in Oracle MySQL Server's Information Schema component affecting versions 8.0.0 through 8.0.45, 8.4.0 through 8.4.8, and 9.0.0 through 9.6.0. The vulnerability allows a low-privileged authenticated attacker with network access to read a subset of sensitive data from affected MySQL instances. The vulnerability presents a medium-severity risk with a CVSS 3.1 base score of 4.3, characterized by network accessibility, low attack complexity, and requirement for low-level user privileges. While the impact is limited to unauthorized data disclosure with no integrity or availability impacts, the ease of exploitation and minimal prerequisites make it a notable concern for organizations running vulnerable MySQL versions. There is currently no evidence of active exploitation in the wild, with an EPSS score of 0.00027 indicating minimal real-world exploitation activity. The vulnerability has not been added to CISA's Known Exploited Vulnerabilities catalog, and no public exploit code is widely available. Community attention remains low, making this a lower-priority threat compared to higher-severity vulnerabilities, though patching should still be scheduled as part of routine MySQL maintenance updates.