‹ Back to list

CVE-2026-92262

Status: AnalyzedCritical (9.9)—PoC
Severity9.9Critical · CVSS 3.1
Exploitation probability0.68 %higher than 51% of CVEs
Active exploitationNonot in the CISA catalog
Public exploitAvailableProof of concept on GitHub (unverified)

News and reports on Orbitaley

MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the #mysql50# bypass prefix is affected because it allows the #mysql50# prefix to bypass normal table-name filesystem encoding. An attacker can trigger the issue with a table name using the #mysql50# prefix, then use a #mysql50# table name to access files under their legacy unencoded name and cause crashes, data corruption, data exfiltration, or remote code execution. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.

CVSS

Base score
9.9
Version
3.1
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Exploitation probability (EPSS)

Probability of exploitation in the next 30 days
0.68 %
Percentile among all scored CVEs
51
Score date
10/20/2026

EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).

Public exploits

Exploit code or detection templates are publicly available. This is not the same as confirmed active exploitation (KEV), but it raises the risk: patch with priority.

⚠️ GitHub proofs of concept are not verified: some are fake or contain malware. Never run them outside an isolated lab.

ATT&CK techniques

How this vulnerability is exploited and what the attacker gains, in MITRE ATT&CK terms.

Vector AV:N/PR:L indica red con privilegios (T1210); el texto cita ejecución remota de código, corrupción de datos y exfiltración vía acceso a ficheros con prefijo #mysql50#.

Inferred by our analysis agent from the official description, CVSS vector and CWE, and checked by a supervisor. May contain errors.

ATT&CK mitigations that cover these techniques

Privileged Account ManagementNetwork SegmentationDisable or Remove Feature or ProgramVulnerability ScanningThreat Intelligence ProgramRestrict Web-Based Content

Affected technologies (1)

Mariadb — Mariadb

CWEs

References

Show 10 references

Raw JSON (NVD)

Show
{
  "id": "CVE-2026-92262",
  "cveTags": [],
  "metrics": {
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 9.9,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 6,
        "exploitabilityScore": 3.1
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "MariaDB",
          "product": "server",
          "versions": [
            {
              "status": "affected",
              "version": ">= 10.6.1, < 10.6.28"
            },
            {
              "status": "affected",
              "version": ">= 10.11.1, < 10.11.19"
            },
            {
              "status": "affected",
              "version": ">= 11.4.1, < 11.4.13"
            },
            {
              "status": "affected",
              "version": ">= 11.8.1, < 11.8.9"
            },
            {
              "status": "affected",
              "version": ">= 12.3.1, < 12.3.3"
            },
            {
              "status": "affected",
              "version": ">= 13.0.1, < 13.0.2"
            }
          ]
        }
      ]
    }
  ],
  "published": "2026-10-16T17:17:52.710",
  "references": [
    {
      "url": "https://github.com/MariaDB/server/commit/574ba66b2d6c5d71db83d416677876e9b592858e",
      "tags": [
        "Patch"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/MariaDB/server/commit/f277eefa424850a8cba5c2371406047f6395e8bb",
      "tags": [
        "Patch"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19",
      "tags": [
        "Release Notes"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28",
      "tags": [
        "Release Notes"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13",
      "tags": [
        "Release Notes"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9",
      "tags": [
        "Release Notes"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3",
      "tags": [
        "Release Notes"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2",
      "tags": [
        "Release Notes"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/MariaDB/server/security/advisories/GHSA-65jj-h265-3m7h",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://jira.mariadb.org/browse/MDEV-40362",
      "tags": [
        "Issue Tracking"
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-706"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the #mysql50# bypass prefix is affected because it allows the #mysql50# prefix to bypass normal table-name filesystem encoding. An attacker can trigger the issue with a table name using the #mysql50# prefix, then use a #mysql50# table name to access files under their legacy unencoded name and cause crashes, data corruption, data exfiltration, or remote code execution. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2."
    }
  ],
  "lastModified": "2026-10-20T15:32:31.767",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6A6667AA-6A82-49E2-894B-318569872468",
              "versionEndExcluding": "10.6.28",
              "versionStartIncluding": "10.6.1"
            },
            {
              "criteria": "cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C18A44B6-CEEF-47D7-9D60-04E6EBAFC785",
              "versionEndExcluding": "10.11.19",
              "versionStartIncluding": "10.11.1"
            },
            {
              "criteria": "cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "47070DA5-F754-4FE1-957A-375C39D9029E",
              "versionEndExcluding": "11.4.13",
              "versionStartIncluding": "11.4.1"
            },
            {
              "criteria": "cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "39AD11EC-57BE-4D2B-9A7C-E667E23A6940",
              "versionEndExcluding": "11.8.9",
              "versionStartIncluding": "11.8.1"
            },
            {
              "criteria": "cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E6988F1C-2D11-431B-BBE4-3AA8483627C8",
              "versionEndExcluding": "12.3.3",
              "versionStartIncluding": "12.3.1"
            },
            {
              "criteria": "cpe:2.3:a:mariadb:mariadb:13.0.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E46FBE57-06D5-489E-9ECE-333F5F9AFD06"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security-advisories@github.com"
}