MySQL Server CVE-2026-101614

Exploitation requires the attacker to already hold a high-privileged MySQL account (confirmed by CVSS PR:H) and network reachability to the MySQL Server or Cluster listener over one of its supported protocols. The target must run an affected release: MySQL Server 8.4.0-8.4.12, 9.7.0-9.7.3, or 26.7.0-26.7.1, or MySQL Cluster 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3, or 26.7.0-26.7.1. The defect is in the InnoDB storage engine, so an InnoDB-backed workload is implied. No user interaction is required (UI:N) and attack complexity is low (AC:L). The primary limiting factor is the high-privilege prerequisite, which confines realistic exploitation to insiders, compromised administrative credentials, or multi-tenant deployments where low-trust principals hold elevated database roles; impact is limited to availability only (no data disclosure or modification).

This is a moderate, not high-priority, issue despite affecting a ubiquitous product. The CVSS 3.1 base score is 4.9 (Medium) with vector AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H - network reachable and low attack complexity, but critically requiring PR:H (high privileges). The impact is strictly availability (complete DOS via hang or repeatable crash) with no confidentiality or integrity impact. The PR:H requirement is the dominant mitigating factor: an attacker must already hold administrative/high-privileged database credentials, meaning a trusted insider or a fully compromised account rather than an anonymous remote actor. No EPSS score, CISA KEV listing, or public POC was provided in the intelligence set, and Oracle's own wording ('Easily exploitable') refers only to attack complexity once the privilege prerequisite is met, not to ease of obtaining those privileges. There is a nuance worth flagging: the description calls it 'Easily exploitable' yet also 'high privileged,' which can read as conflicting - the resolution is that AC:L (easy) and PR:H (privileged) coexist and are both confirmed by the CVSS vector. Net assessment: real but limited risk, appropriate for scheduled patching rather than emergency response, with priority raised only for multi-tenant or shared database environments where low-trust users may hold elevated roles.

An attacker who already possesses high-privileged MySQL credentials (e.g., a malicious DBA, a compromised admin account, or an untrusted tenant with elevated roles in a shared cluster) connects over the network via one of MySQL's supported protocols and issues a crafted request that triggers the InnoDB defect. The result is a hang or repeatedly reproducible crash, producing a complete denial of service for the database and all dependent applications. No public exploit was identified at time of analysis, so exploitation would require independent development.