CVE-2026-3494
Published: 03 March 2026
Summary
CVE-2026-3494 is a medium-severity Insufficient Logging (CWE-778) vulnerability in Amazon Relational Database Service. Its CVSS base score is 5.3 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Indicator Removal (T1070); ranked at the 19.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-9311
Vulnerability details
In MariaDB server version through 11.8.5, when server audit plugin is enabled with server_audit_events variable configured with QUERY_DCL, QUERY_DDL, or QUERY_DML filtering, if an authenticated database user invokes a SQL statement prefixed with double-hyphen (—) or hash (#) style comments,…
more
the statement is not logged.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Bypasses database audit logging via SQL comment prefixes, directly enabling log evasion (indicator removal) and defense impairment for authenticated actions.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Audit policy requires defining and implementing logging of security-relevant events, directly reducing insufficient logging.
Providing proof of performed actions necessitates sufficient logging of security-relevant events with attribution details.
Retaining audit records for a defined period ensures security-relevant events remain available for after-the-fact investigations, directly mitigating the risk that attackers can hide actions due to missing or purged log data.
Directly requires generation of audit records for specified events, preventing the absence of logging that allows undetected malicious activity.
Directly implements detailed session logging to address the weakness of insufficient logging.
Provides alternate logging mechanism to maintain audit trails when primary capability fails, directly reducing insufficient logging.
Employing coordination mechanisms ensures consistent and sufficient logging practices are applied when audit information crosses organizational boundaries.
This control requires identifying, specifying, and justifying event types for logging with a focus on adequacy for post-incident investigations, directly mitigating insufficient logging.