Technology & security · · 8 min read · By Alexander
Critical MariaDB security vulnerabilities: What you should do now
The research available as of 30 October 2026 documents several security vulnerabilities in the MariaDB database server. Two of them, CVE-2026-92262 and CVE-2026-85746, each score 9.9 out of 10 under the CNA’s CVSS 3.1 assessment. An update should therefore be a high priority. For both main vulnerabilities, an attacker already needs a low-privileged database account and the corresponding SQL access. An anonymous visit to your website does not automatically meet this requirement. Ask for confirmation of the MariaDB patch level actually running and who is allowed to access the database.
What happened with MariaDB?
CVE-2026-92262 concerns table names: The historic prefix “#mysql50#” bypasses their normal conversion into file names. The CNA record lists crashes, corrupted data, data leakage and possible remote code execution. The CNA rates the vulnerability 9.9 under CVSS 3.1.
With CVE-2026-85746, deeply nested GeometryCollections can cause the GIS function “ST_AsText” to write beyond its output buffer. Here too, the CNA rating is 9.9 under CVSS 3.1. The record describes possible code execution only in combination with another vulnerability. Reliable, standalone remote code execution has therefore not been demonstrated.
According to the record, CVE-2026-85748 affects only the specified ranges of branches 12.3 and 13.0. It is caused by a use-after-free error involving many “SYS_REFCURSOR” objects. The CNA also rates this vulnerability 9.9 under CVSS 3.1. The possible code execution described likewise requires another vulnerability. Older branches must not be broadly classified as affected by this CVE.
How dangerous are the vulnerabilities in practice?
9.9 is a critical rating. CVSS describes the technical severity under the stated conditions; it does not indicate the likelihood of an attack on your website. All three assessment vectors specify network access, low complexity, no required user interaction and potentially high impact on confidentiality, integrity and availability.
At the same time, “PR:L” for all three vulnerabilities means that low privileges must already be available. Database administrator rights are therefore not essential. The available description is less precise about the individual privileges required for CVE-2026-92262. You should therefore also have restricted accounts checked.
Active exploitation is not demonstrated in the available material. For the CVE identifiers checked, the saved CISA KEV check against the catalogue as of 29 October 2026 returned no matches. Absence from this catalogue of known exploited vulnerabilities does not rule out attacks. The update recommendation is based on the critical severity and the documented attack requirements.
Which MariaDB versions are secure?
According to the CNA, the following fixed versions address CVE-2026-92262 and CVE-2026-85746. This is not a general security guarantee or a statement about how long a branch will be supported.
- MariaDB 10.6: fixed version 10.6.28
- MariaDB 10.11: fixed version 10.11.19
- MariaDB 11.4: fixed version 11.4.13
- MariaDB 11.8: fixed version 11.8.9
- MariaDB 12.3: fixed version 12.3.3
- MariaDB 13.0: fixed version 13.0.2
Moving to MariaDB 12 or 13 is not necessary solely because of these main vulnerabilities. Ask for the appropriate fixed version and the support status of your branch to be checked. The research provides no all-clear for branches not listed or for specific distribution packages. If your provider refers to a backport, meaning a correction incorporated into its package version, ask for evidence covering both main CVEs. CVE-2026-85748 specifically affects 12.3.1 up to but not including 12.3.3, and 13.0.1 up to but not including 13.0.2; the corresponding fixed versions are 12.3.3 and 13.0.2.
How can I check whether my website is affected?
The following guidance is an editorial recommendation based on the documented requirements and fixed versions. First determine whether your website uses MariaDB. Have the running server version and the complete package version, including the package source, identified. If you have SQL access, the read-only query “SELECT VERSION();” returns the running server version. You should also ask for confirmation that the provider’s package version contains the correction.
With Shared Hosting, we recommend first asking the provider who is responsible for the database. Even if you use Plesk or cPanel, clarify who will carry out the server update. The patch level cannot be inferred from the name of an administration interface.
For WordPress, we recommend the same check of the database version. Compromised database credentials or a web application vulnerability would have to be demonstrated separately as possible additional access routes; no such attack chain is established here. Also ask for a check of which accounts are allowed to execute SQL. The absence of administrator rights is not enough to give the all-clear.
What should I write to my hosting provider?
You can use the following request as an editorial suggestion. Keep the response so that the confirmed status remains traceable:
“Hello, which MariaDB version is running for my website? Please also provide the complete package or build identifier and the package source. Have CVE-2026-92262 and CVE-2026-85746 been fixed in it? If you use a backport, please send me suitable evidence. If an affected version from branches 12.3 or 13.0 is in use, I would also like information about CVE-2026-85748. Which accounts and networks are allowed to access the database? If an update is still required, who will carry it out and when? Please coordinate the backup and compatibility check with me beforehand, and the subsequent check of the running version and website functions.”
A response such as “The website is running” does not answer the question about the CVEs. If the information is unclear, ask for specific confirmation. For a functional test, we recommend checking the processes you actually use on your website, such as placing an order in the online shop or signing in to the customer area.
What should I do if the update cannot be applied immediately?
As a temporary measure, have database access restricted to the accounts and networks that are required. Together with the responsible specialist, check which access paths are unnecessary and which privileges the applications need. This can reduce the attack surface. The available main advisories do not establish this as a complete substitute for the update; low database privileges are also among the attack requirements.
Agree a specific date for the update. We recommend checking that you have a current backup and that your applications are compatible beforehand. A general reference to additional protective measures is not sufficient evidence that the CVEs have been fixed. Ask for explicit confirmation of the corrected package version.
After the update, check the server version actually running and the operation of your applications. If you use managed hosting, delegate this check to the responsible provider. If the patch level remains unclear, ask specifically for the missing evidence. Document the confirmed version and the result of the functional test for your records.
Frequently asked questions about the MariaDB security update
Are up-to-date WordPress plugins enough?
Our editorial recommendation is to have the MariaDB patch level checked independently of plugin updates. The listed fixed versions relate to the database server. Up-to-date plugins do not prove that these corrections have been installed there.
Does Cloudflare provide protection?
The research contains no evidence that Cloudflare protects against these vulnerabilities. We therefore recommend having the MariaDB patch level confirmed and prioritising the required database update even if you use it.
Does this affect static websites?
The following can be inferred from the affected product: A purely static website that does not use MariaDB through any supplementary services has no MariaDB patching requirement of its own here. If you use additional database functions, we recommend asking the provider about their database system and patch level.
Is every WordPress website automatically affected?
No. Check whether an affected MariaDB version is in use. An attack also requires low database privileges and the corresponding SQL access; an anonymous website visit is not automatically sufficient. This is an inference from the documented requirements.
Has my website already been hacked?
The CVE notice does not answer this question. Active exploitation is not demonstrated in the material; the saved KEV check as of 29 October 2026 returned no matches for the identifiers checked. This does not prove that your website is intact. If you notice specific anomalies, we recommend a professional investigation.
Do I need to upgrade to MariaDB 12 or 13?
That is not necessary solely because of the two main vulnerabilities. Fixed versions are documented for several older branches. Ask for an appropriate corrected version to be selected and clarify the support status of your branch separately. A provider patch requires specific evidence that the vulnerabilities have been fixed.