October 22, 2026 at 8:55 PM EDT
MariaDB privilege escalation (CVE-2026-107823)
high
A high-severity MariaDB flaw lets an account that can already create users and views grant itself more privileges. Fixed releases are available on every supported branch.
MariaDB: CVE-2026-107823
- What: CVE-2026-107823 is a privilege escalation in MariaDB Server. A database account that already holds
CREATE USERplusCREATE VIEW ... WITH GRANT OPTIONcan give itself additional privileges. - Severity: High (7.2).
- Exploited: Not known to be exploited in the wild.
- Fixed in: 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3 and 13.0.2.
- Mitigation: Upgrade to the fixed release for your branch. Until then, make sure application database accounts (for example, a CMS's database user) do not hold
CREATE USERorCREATE VIEW WITH GRANT OPTION. Accounts without those permissions cannot use this path.
Also noted
- Wordfence reports that attack attempts targeting PHP2Shell (CVE-2026-109618 / CVE-2026-109619) are ongoing, although it has not reported a confirmed successful compromise. Sites on older PHP builds should update.
General information only. Confirm fixed versions in the linked official advisories before patching.