MySQL Server CVE-2026-101615

Exploitation requires the attacker to have logon access to the infrastructure (host) where MySQL Server or MySQL Cluster executes AND to hold high database privileges (PR:H), per the CVSS vector and Oracle description - this is not remotely or unauthenticated-exploitable. The vulnerable component is InnoDB in MySQL Server 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1 and MySQL Cluster 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1. Limiting factors: the local attack vector (AV:L) and high-privilege requirement confine the attacker set to privileged insiders or already-compromised privileged accounts, and the only achievable impact is denial of service (hang or repeatable crash) with no confidentiality or integrity loss.

This is a low-to-moderate priority issue that scores as a genuine but constrained risk. The CVSS 3.1 base score of 4.4 (MEDIUM) is driven entirely by availability impact (A:H) with no confidentiality or integrity effect (C:N/I:N). The vector CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H confirms that exploitation requires LOCAL access (AV:L - logon to the infrastructure where the server runs) and HIGH privileges (PR:H), which sharply limits the attacker population to those who already hold privileged database/host access. The description's 'easily exploitable' phrasing aligns with AC:L (low complexity) but does not elevate real-world risk because the PR:H prerequisite is the dominant limiting factor. No EPSS score, CISA KEV listing, or POC was provided in the input, so there is no signal of active exploitation or available exploit code - the only outcome is a hang or repeatable crash (complete DOS) of the affected instance, not code execution or data compromise. There are no conflicting signals here: the CVSS vector and the prose description agree that this is a local, high-privilege, availability-only flaw. A privileged user who can already crash a database by other means (e.g., resource exhaustion) gains little new capability, so this ranks below internet-facing or unauthenticated vulnerabilities for patch prioritization.

An attacker who already holds high database privileges and can log on to the host where MySQL Server or Cluster runs issues a crafted query or operation that triggers the InnoDB defect, causing the server to hang or enter a repeatable crash loop (complete denial of service). No public exploit code or active exploitation was identified in the provided data, and because it requires both local logon and high privileges, the realistic threat is an insider or an attacker who has already compromised a privileged account.