Vulnerability in Amazon Aurora MySQL
CVE-2026-3494
In MariaDB server version through 11.8.5, when server audit plugin is enabled with server_audit_events variable configured with QUERY_DCL, QUERY_DDL, or QUERY_DML filtering, if an authenticated database user invokes a SQL statement prefixed with double-hyphen (—) or hash (#) style comments, the statement is not logged.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 4.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N.
EPSS exploit prediction
EPSS: 0.004 (29.6th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 30th percentile — 29.6% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.003 · newest: 0.004 · change: +0.001
Affected products
- Amazon Aurora MySQL — versions 2.12.6, 3.04.6, 3.10.3
- Amazon Aurora MySQL — versions 3.11.0
- Amazon Rds For Mariadb — versions 10.6.25, 10.11.16, 11.4.10
- Amazon Rds For MySQL — versions 5.7.44-RDS.20260212, 8.0.45, 8.4.8
- Amazon Relational Database Service
- Mariadb
- Mariadb Foundation Server — versions 10.6.25, 10.11.16, 11.4.10
Weakness classification (CWE)
Public proof-of-concept exploits
References
- ff89ba41-3aa1-4d27-914a-91399e9639e5 (vendor-advisory, Third Party Advisory)
- ff89ba41-3aa1-4d27-914a-91399e9639e5 (Patch, patch)
- ff89ba41-3aa1-4d27-914a-91399e9639e5 (Patch, patch)
Frequently asked questions
- What is CVE-2026-3494?
- CVE-2026-3494 is a medium-severity vulnerability in Amazon Aurora MySQL, classified under CWE-778. CVSS score: 4.3/10. Published 2026-03-03.
- How severe is CVE-2026-3494?
- Medium severity. CVSS v3 base score is 4.3 out of 10.
- Is CVE-2026-3494 known to be exploited?
- 2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.