# MariaDB Security Vulnerabilities (CVE-2026-107814 to 107823): How xCloud Is Patching Your Servers

> MariaDB vulnerability fixes for flaws up to 9.9 are in 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3 and 13.0.2. See what xCloud patches and what you must do.

**The listed flaws in this MariaDB vulnerability group are fixed in 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3 and 13.0.2.** On xCloud, we install your branch's fixed release in your server's update window after 72 hours of notice, except on Ubuntu 20.04, which can only get the security settings. Or click **'Update now'** today. Your server stays on its branch.

This update follows our recent [**PHP advisory**](/php-cve-2026-115560/). This post explains what the notice means, why you might not see the button and what the rollback warning covers.

It also lists what was fixed, who can exploit it, what xCloud is doing, what is still your job and how to patch MariaDB yourself on another host.

## **TL;DR: MariaDB CVE-2026-107814 to 107823 in 30 Seconds**

- **What it is:** five high-severity MariaDB flaws in this group, scored 7.2 to 8.5.
- **The bigger number:** the same releases also fix other flaws, including **two rated 9.9**. Install the release. Don't only apply a workaround.
- **Who can exploit them:** every high-severity record we opened needs a database login or more, so anonymous visitors are not the direct risk.
- **On xCloud:** the patch runs automatically in stages, inside your **Security Update** window, except on Ubuntu 20.04, which can only get the security settings. MariaDB restarts once, for a few seconds.
- **Your databases are not backed up by the patch.** Take your own backup first if you want one. You can't go back to the old version afterwards.
- **You need to act if:** your server runs Ubuntu 20.04 (xCloud applies the security settings in your update window, but you still need to move the server), an app uses the CONNECT engine, or an app reads and writes files through MariaDB.
- **MariaDB 10.6 has reached end of life.** 10.6.28 is its last release, so plan your move.

## **The Five Flaws in the Headline Are Not the Worst Ones in This Update**

The title of this post names CVE-2026-107814 to 107823. **The releases that fix them also fix more serious flaws.** The [**MariaDB 11.8.9 release notes**](https://mariadb.com/docs/release-notes/community-server/11.8/11.8.9) list 22 CVEs, and 10 of them score 7.0 or higher.

| **CVE** | **CVSS 3.1** | **What it is** | **Login needed** |
|---|---|---|---|
| CVE-2026-92262 | 9.9 | A special table-name prefix gets around a safety check. An attacker could crash the server, damage or copy data, or run code. | Low privilege |
| CVE-2026-85746 | 9.9 | A crafted query on geometry (map) data writes past the memory it was given. | Low privilege |
| CVE-2026-97380 | 8.8 | A low-privilege user can set the password of another account they can name. | Low privilege |
| CVE-2026-102523 | 8.0 | Listed in the release notes, no public record we could open | Not confirmed |
| CVE-2026-86047 | 7.7 | A database dump or command output can carry hidden commands that run when someone applies it. | Low privilege, plus a victim's action |

This changes what a sensible response looks like. A security setting can block some of the headline flaws, but **only the fixed release covers the whole list**.

"Low privilege" means an ordinary database login, the kind one app uses. On a server that hosts several sites, a leaked login from one site is the realistic way in. You can read one example in the [**record for CVE-2026-92262**](https://www.cve.org/CVERecord?id=CVE-2026-92262).

## **What Are the Five MariaDB Vulnerabilities?**

These are the five high-severity flaws in the CVE-2026-107814 to 107823 group. The range is a label, not a count: the others we found in it score below 7.0. CVE-2026-107820 in that range belongs to another product, not MariaDB.

| **CVE** | **CVSS 3.1** | **What an attacker can do** | **What they need first** |
|---|---|---|---|
| CVE-2026-107815 | 8.5 | Crash the server and possibly run code, using a memory bug in the CONNECT engine | A low-privilege login and the CONNECT engine |
| CVE-2026-107814 | 8.4 | Plant files that run when an admin logs in to the database's system account | A database login that can read and write server files (the FILE privilege), on a Linux system that uses RPM packages, such as Red Hat |
| CVE-2026-107818 | 8.4 | Slip their own startup values into MariaDB when it next restarts | A database login that can read and write server files (the FILE privilege), and a setting that lets it write to the folder MariaDB uses while running |
| CVE-2026-107821 | 8.0 | Crash the server and possibly run code, using a crafted table file | The ability to place a crafted file in the data directory |
| CVE-2026-107823 | 7.2 | Gain more privileges through a crafted username in a view | High privileges |

**One detail about CVE-2026-107814:** This flaw does not affect MariaDB packages on Debian. It mainly affects servers on Linux systems that use RPM packages, such as Red Hat.

CISA's assessments in these five records, dated October 2026, show **no known exploitation**. That can change, and it is not a reason to wait.

## **Which MariaDB Versions Are Affected and Which Versions Fix Them**

The CVE records we opened list the same ranges. Find your branch, then install the release in the last column. You stay on the same branch.

| **Your branch** | **Affected versions** | **Fixed release** |
|---|---|---|
| MariaDB 10.6 | 10.6.1 to 10.6.27 | 10.6.28 (final 10.6 release) |
| MariaDB 10.11 | 10.11.1 to 10.11.18 | 10.11.19 |
| MariaDB 11.4 | 11.4.1 to 11.4.12 | 11.4.13 |
| MariaDB 11.8 | 11.8.1 to 11.8.8 | 11.8.9 |
| MariaDB 12.3 | 12.3.1 to 12.3.2 | 12.3.3 |
| MariaDB 13.0 | 13.0.1 | 13.0.2 |

MariaDB [**ended community support for 10.6 on 6 July 2026**](https://mariadb.org/mariadb-server-12-3-11-8-11-4-and-10-11-q3-2026-maintenance-releases-and-goodbye-10-6/). It says there will be no 10.6.29 and recommends moving to 11.8 or 12.3. So 10.6.28 fixes this round, but it will not fix the next one.

## **How xCloud Is Patching Your Servers**

### **New servers**

[**New servers install MariaDB 11.8**](/docs/install-mariadb-with-xcloud/), and MariaDB 10 can no longer be chosen. Since [**v2.9.7**](/changelog/v2-9-7/), an install stops if the version is below the security fix, and file import and export are restricted from the start.

### **Existing servers**

Since 28 October 2026 ([**v2.9.7.2 notes**](/changelog/v2-9-7-2/)), we apply the patch to existing MariaDB servers a few at a time. Here is how it runs:

1. **Notice.** Teams were emailed from 28 October 2026 with each affected server and its time.
2. **Patch Date.** This is 72 hours after the notice.
3. **A few servers first.** A small group goes first, then the rest follow from a day later.
4. **Your own window.** Each server starts inside the hour that begins at its **Security Update** time, never outside it.
5. **Offline servers.** A server we can't read gets its time once it is back online.

The rollout pauses if an early server fails to start, has to be restored, shows a site outage or reports a database storage error.

![The Security Patches card on an xCloud demo server, with its status, installed version, Patch Date and the Update now button](/_landing/docs/apply-the-mariadb-security-patch-in-xcloud-image-2.png)

### **What changes on your server**

- **The fixed release** for your current branch. Packages are never removed or downgraded.
- **File import and export are restricted.** `SELECT ... INTO OUTFILE` and `LOAD DATA` without `LOCAL` can only use `/var/lib/mysql-files`.
- **The CONNECT engine is disabled.** If any of your tables use it, the update stops before it changes anything and asks you to contact support.
- **One MariaDB restart,** for a few seconds.

Each of the two security settings blocks one flaw above. The file restriction addresses CVE-2026-107818, and turning CONNECT off addresses CVE-2026-107815. The rest need the fixed release.

## **Do You Need to Do Anything?**

**For most xCloud servers, no.** Open the card to check your date, or patch earlier. The full walkthrough is in our guide to [**applying the MariaDB security patch**](/docs/apply-the-mariadb-security-patch-in-xcloud/).

| **Your setup** | **What happens** | **Your action** |
|---|---|---|
| MariaDB on a supported Ubuntu release | Patched on or after your Patch Date | None, or click **'Update now'** |
| An app that imports or exports files through database commands (`INTO OUTFILE`, `LOAD DATA` without `LOCAL`) | Those files must move to `/var/lib/mysql-files` | Check the app before you patch |
| Tables that use the CONNECT engine | The update stops before changing anything | Contact [**support**](/docs/access-built-in-support-portal-in-xcloud/) |
| Ubuntu 20.04 | Status reads **Unpatchable**. xCloud applies the security settings in your update window | Click **'Apply hardening'** to do it now if you prefer. Either way, move the server |
| MariaDB 10.6 | Patched to 10.6.28, the final release | Plan a move to 11.8 |
| Your own MariaDB in Docker | Not covered by this patch | Update your image yourself |
| MySQL | Not affected, no card shown | None |

### **Why you might not see the Update now button**

Members without the **Security Update** permission see a message asking them to contact a teammate who has it. A server that isn't connected, or that we haven't checked in the last 24 hours, can't be updated until it is checked again.

To find the card, open the server and look for the banner. Click **'Review in Security Update'**, or go to **'Security'** → **'Security Update'**.

![The MariaDB security patch banner on an xCloud server page, with the Review in Security Update link](/_landing/docs/apply-the-mariadb-security-patch-in-xcloud-image-1.png)

### **Ubuntu 20.04: hardening is not the fix**

On Ubuntu 20.04, the fixed packages aren't available, so xCloud can only apply the security settings. It does this in your update window, or you can click **'Apply hardening'** to do it now. That helps with two of the flaws above. **It does not fix the others, including the two rated 9.9.**

Move those sites to a server on a supported Ubuntu release. Our guide to [**migrating all sites between two xCloud servers**](/docs/full-server-migration-between-xcloud-servers/) walks through it. The new server gets MariaDB 11.8, which also solves the 10.6 end-of-life problem.

## **What This Patch Does Not Do**

Here is the part to read before you click.

- **It does not back up your databases.** The safety backup only holds MariaDB's settings and its built-in user and permission data, not your site data. Use [**backups in xCloud**](/docs/backups-in-xcloud/) if you want a copy of your data first.
- **It cannot be undone.** You can't go back to the old version afterwards. If MariaDB can't start, recovery restores the previous security settings and tries one restart.
- **It is not a major upgrade.** A server on 10.6 stays on 10.6.
- **It does not guarantee a first-try success.** A server gets up to three update runs. After a failure, the card shows the reason and what to do next.
- **It does not cover future releases.** On MariaDB 11.8, to get later releases automatically, turn on **Managed Service Updates** on the **Security Update** page. Our guide to [**automated security updates**](/docs/how-automated-security-updates-and-auto-reboot-work-in-xcloud/) explains how it works.

We also can't say here that every server is done, because the rollout is staged. **Your card always shows the real status.**

## **Not on xCloud? How to Update MariaDB Yourself**

Here is the order to follow on a Debian or Ubuntu server. Try it on a copy first if you can.

**1. Back up and check your version.**

```bash
sudo mariadb-dump --all-databases --single-transaction --routines --events --triggers > all-databases.sql
sudo mariadb -e "SELECT VERSION();"
```

**2. Install the fixed release for your branch.** Stay on the same branch, and update all your MariaDB packages, not only the server package. Follow MariaDB's own guides to [**upgrading MariaDB**](https://mariadb.com/docs/server/server-management/install-and-upgrade-mariadb/upgrading) and [**installing its .deb packages**](https://mariadb.com/docs/server/server-management/install-and-upgrade-mariadb/installing-mariadb/binary-packages/installing-mariadb-deb-files).

If your packages come from your Linux distribution, check its security notice, since version numbers can differ.

**3. Restrict file access.** Create the folder, then put the setting in a new file, such as `/etc/mysql/mariadb.conf.d/90-secure-file-priv.cnf`.

```bash
sudo install -d -o mysql -g mysql -m 0750 /var/lib/mysql-files
```

```ini
[mysqld]
secure_file_priv=/var/lib/mysql-files
```

Restart MariaDB:

```bash
sudo systemctl restart mariadb
```

Then run `SHOW VARIABLES LIKE 'secure_file_priv';`. The value should show `/var/lib/mysql-files`, with or without a slash at the end.

**4. Check for the CONNECT engine.** Look for tables that use it before you change anything.

```sql
SELECT TABLE_SCHEMA, TABLE_NAME FROM information_schema.TABLES WHERE ENGINE = 'CONNECT';
```

If no table uses it, you can turn it off. MariaDB's [**CONNECT install page**](https://mariadb.com/docs/server/server-usage/storage-engines/connect/installing-the-connect-storage-engine) explains how to uninstall the plugin.

**5. Review your database logins.** Most of these flaws start from an existing login. Remove old accounts, and give apps only the rights they need.

If you already manage your servers over SSH on xCloud, our guide to [**updating MariaDB or MySQL via SSH**](/docs/update-mariadb-or-mysql-on-xcloud-server-via-ssh/) covers the same-branch update for MariaDB 11.8. On other branches, use the **Security Patches** card on the server's **Security Update** page. You can also [**configure MySQL and MariaDB**](/docs/configure-mysql-and-mariadb-with-xcloud/) from the dashboard.

## **Timeline**

- **13 August 2026:** MariaDB releases 10.6.28, the final 10.6 release.
- **24 August 2026:** MariaDB releases 10.11.19, 11.4.13, 11.8.9 and 12.3.3.
- **September 2026:** MariaDB releases 13.0.2.
- **9 October 2026:** the MariaDB records in the CVE-2026-107814 to 107823 range are published.
- **27 October 2026:** xCloud v2.9.7 makes new-server installs safer.
- **28 October 2026:** xCloud notifies teams. Each affected server gets a Patch Date 72 hours after its notice.
- **31 October 2026 onward:** the first servers can be patched in their own update windows, and the rest follow in stages.

## **Patch Yours Now, Then Stop Chasing Database Advisories**

If you have a MariaDB server on xCloud, open its **Security Update** page today and read the card. If the restart suits you, click **'Update now'** and skip the wait.

Then think about the next advisory. Our guide to [**automated security updates**](/docs/how-automated-security-updates-and-auto-reboot-work-in-xcloud/) explains what is covered and what needs a switch turned on. If you are setting up a new database, start with our [**MariaDB setup guide**](/guide-to-setup-mariadb-database-with-xcloud/).

The honest trade-off: running your own server gives you full control, and you read every advisory yourself. [**Managed hosting**](/managed-hosting/) and [**WordPress hosting**](/hosting-for-wordpress/) on xCloud move that work to us, with a notice, a date and a button when something needs your decision.

If you have found this blog helpful, feel free to [**subscribe to our blogs**](https://xcloud.host/blog/) for valuable tutorials, guides, knowledge, and tips on web hosting and server management. You can also join our [**Facebook community**](https://www.facebook.com/groups/xcloud.community) to share insights and engage in discussions.

## **Frequently Asked Questions**

### **Which MariaDB versions fix these vulnerabilities?**

The fixed releases are 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3 and 13.0.2. Install the one for the branch you already run. You do not need a major upgrade to get the fix.

### **Can someone attack my MariaDB server without a database login?**

Not for the high-severity flaws we checked. Each CVE record we opened requires at least a low-privilege database login, and some need admin-level rights or file access. A leaked login is the realistic starting point, so these fixes still matter.

### **Is my xCloud server already patched?**

Check the **Security Patches** card on the server's **Security Update** page. It shows your status, installed version and Patch Date. Servers are patched in stages, so do not assume yours is done until the card reads **Patched**.

### **Does xCloud back up my databases before the update?**

No. The safety backup only holds MariaDB's settings and its built-in user and permission data, not your site data, and you can't go back to the old version afterwards. Take your own database backup first if you want a copy of your data.

### **Will my sites go offline during the update?**

MariaDB restarts once for a few seconds. Requests made in those few seconds may fail and can be retried. The rest of the server keeps running.

### **What should I do with a server on Ubuntu 20.04?**

xCloud applies the security settings in your update window, or click **'Apply hardening'** to do it now. Either way, move the server to a supported Ubuntu release. The fixed packages are not available on Ubuntu 20.04, and the security settings alone do not fix every vulnerability in this update.