Port 3306 (MySQL) is targeted by brute-force attacks, credential stuffing, database enumeration, and exploitation of exposed or misconfigured instances. Attackers may try weak accounts, insecure remote access, or privilege escalation through database misuse. Defenders should restrict network access, enforce strong credentials, patch regularly, and monitor for unusual queries and login failures.
Why Port 3306 Attracts Direct Attack Attempts
Port 3306 is attractive because it often exposes a database service with valuable data, powerful credentials, and administrative pathways. Attackers do not need a complex exploit if they can reach an open MySQL listener and guess, reuse, or harvest valid access. The strongest defence is to make the service unreachable from untrusted networks unless there is a clear business reason.
MySQL exposure is rarely just about one host. A public listener can become a broad attack surface for password guessing, account discovery, and opportunistic probing of default or weak configurations, especially when remote administration was enabled for convenience.
For a broader map of risky services and exposed management ports, Network Ports and Protocols Security Guide is the right starting point.
How Attackers Work Against MySQL
Brute-force attacks and credential stuffing are the most common pressure points because many MySQL deployments still rely on password authentication and external exposure. If an attacker finds a reachable instance, they can try known usernames, reused passwords, and low-friction login attempts until one account works. Once inside, they may enumerate schemas, inspect permissions, and look for a path to broader database or host compromise.
Database enumeration matters because it turns one successful login into a map of what the server knows, who can access it, and which tables or accounts are misconfigured. In practice, a weak MySQL account is often more dangerous than the service itself, because excessive privilege can let an attacker read sensitive data, alter records, or abuse the database as a pivot point.
Attackers also target exposed or misconfigured instances that allow remote access without adequate filtering, host binding, or privilege separation. A reachable service is not automatically vulnerable, but it becomes much easier to pressure when network controls, account hygiene, and logging are weak at the same time.
What Defenders Should Validate First
The first question is not whether MySQL is installed, but who can reach it and why. If port 3306 is open beyond the systems that truly need it, the exposure itself becomes part of the problem. Restrict access to known application hosts, require strong credentials, and review whether any account still has broader privileges than the application actually needs.
Detection should focus on the patterns that precede compromise: repeated authentication failures, login attempts from unusual source addresses, new database users, unexpected privilege changes, and queries that do not match the normal workload. Patching and configuration review matter, but they work best when the service is already narrowed to the smallest practical network footprint.
For practical threat context on how exposed services are probed and abused, CISA cyber threat advisories are a useful external reference point, and MITRE ATT&CK Enterprise Matrix helps map brute force, credential access, and privilege escalation behaviours to defensive hunts.
Risk and Threat Considerations
Port 3306 becomes materially riskier when it is reachable from untrusted networks, because the attack path is often simple: enumerate the service, guess or reuse credentials, then expand access through overprivileged database accounts or poor segmentation. The impact can include data exposure, integrity loss, and use of the database as a stepping stone into adjacent systems.
Failure mechanism: Exposed listeners, weak authentication, reused passwords, and excessive database privileges combine to make unauthorized access practical even without a software exploit.
Impact: Attackers can exfiltrate data, modify records, create persistence through new accounts, and use the database as a launch point for further intrusion.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while CIS Controls v8 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | T1110 — Brute Force | MySQL 3306 is commonly attacked through password guessing and credential stuffing. |
| T1078 — Valid Accounts | Successful MySQL compromise often uses stolen or reused credentials rather than exploits. | |
| Recommendation — Detect repeated login attempts and throttle or block sources showing brute-force patterns. Monitor for anomalous use of valid database accounts and remove unnecessary credentials. | ||
| CIS Controls v8 | CIS-4 — Secure Configuration of Enterprise Assets and Software | Exposed MySQL instances are often harmed by insecure network exposure and misconfiguration. |
| Recommendation — Harden MySQL exposure, close unnecessary access paths, and enforce approved configurations. | ||
| NIST SP 800-53 Rev 5 | AC-3 — Access Enforcement | MySQL attacks succeed when network and account access is broader than required. |
| IA-5 — Authenticator Management | Weak or reused database credentials are a primary attack path against port 3306. | |
| Recommendation — Enforce least-privilege access rules for database users and reachable hosts. Rotate, strengthen, and govern database credentials to reduce guessing and reuse risk. | ||
Practitioner Guidance
What to verify: Confirm whether port 3306 is reachable only from approved application or administration networks, and verify that every active MySQL account has a clear owner, a current purpose, and the minimum privileges needed for that purpose.
Decision rule: If the instance is internet-facing or reachable across broad internal segments, treat it as an exposure problem first and a credential problem second. Reduce reachability, then rotate or retire any account that could be abused before assuming the service is otherwise safe.
Practitioner takeaway: For MySQL, the decisive control is usually not the banner on the port, it is whether the service is reachable, the account model is tight, and the logs are good enough to spot guessing before access turns into data loss.