CVE-2026-3494: mariadb through 10.6.24 (inclusive), from 10.7.0 (inclusive), through 10.11.15 (inclusive), from 11.0.0 (inclusive)…

CVE-2026-3494 affects cbl2 mariadb 10.6.24-1 on CBL Mariner 2.0. CVSS 3.1 base score 4.3 (msrc). EPSS 0.00372 (percentile 0.28882), scored 03-Oct-2026.

Affected technology

mariadb · through 10.6.24 (inclusive)
mariadb

mariadb · from 10.7.0 (inclusive), through 10.11.15 (inclusive)
mariadb

mariadb · from 11.0.0 (inclusive), through 11.4.9 (inclusive)
mariadb

mariadb · from 11.5.0 (inclusive), through 11.8.5 (inclusive)
mariadb

aurora mysql · through 2.12.5 (inclusive)
amazon

aurora mysql · from 3.01.0 (inclusive), before 3.04.6 (exclusive)
amazon

aurora mysql · from 3.05.1 (inclusive), through 3.10.2 (inclusive)
amazon

aurora mysql · 3.11.0
amazon

relational database service · through 5.7.44-rds.20251212 (inclusive)
amazon

relational database service · through 10.6.24 (inclusive)
amazon

relational database service · from 8.0.11 (inclusive), through 8.0.44 (inclusive)
amazon

relational database service · from 8.4.3 (inclusive), through 8.4.7 (inclusive)
amazon

relational database service · from 10.11.4 (inclusive), through 10.11.15 (inclusive)
amazon

relational database service · from 11.4.3 (inclusive), through 11.4.9 (inclusive)
amazon

relational database service · from 11.8.3 (inclusive), through 11.8.5 (inclusive)
amazon

MariaDB Server · 0 to before 10.6.25, 0 to before 10.11.16, 0 to before 11.4.10, 0 to before 11.8.6
MariaDB Foundation

Aurora MySQL · 0 to before 2.12.6, 0 to before 3.04.6, 0 to before 3.10.3, 0 to before 3.11.1
Amazon

RDS for MySQL · 0 to before 5.7.44-RDS.20260212, 0 to before 8.0.45, 0 to before 8.4.8
Amazon

RDS for MariaDB · 0 to before 10.6.25, 0 to before 10.11.16, 0 to before 11.4.10, 0 to before 11.8.6
Amazon

Description’s affected range: version through 11.8.5

Component: Not specified by the source

Attack conditions (Source advisory, CVSS 4.0): Network (remote) · Low privileges required · No user interaction required

What an attacker can do

Source advisory’s CVSS 4.0 assessment (base score 5.3/10) rates confidentiality and availability impact as none; integrity impact as low. The description does not specify what an attacker can achieve beyond these rated impacts.

Published 20-Oct-2026 21:23 UTC

CWE: CWE-778
Product: cbl2 mariadb 10.6.24-1 on CBL Mariner 2.0
CCR priority: 17.3 /100 (P5)
CVSS 3.1: 4.3 /10 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N · Source advisory
EPSS: 0.00381 · percentile 0.30617 · 2026-10-20
KEV: no

Provenance

FIRST EPSS daily exploit-probability · Source record · observed 2026-10-20 16:56:29.772392+00:00 UTC
Microsoft MSRC Security Update Guide (CVRF) · Source record · observed 2026-10-04 07:08:49.022374+00:00 UTC
NVD CVE API 2.0 · Source record · observed 2026-10-20 21:22:07.084487+00:00 UTC

Stable permalink: https://cybercodered.org/item/cve-cve-2026-3494.html