Oracle MySQL Server CVE-2026-101617

Exploitation requires an authenticated attacker holding HIGH privileges on the target (PR:H) with network access to MySQL Server or MySQL Cluster via one of its supported protocols; the flaw resides in the InnoDB storage engine. The high-privilege prerequisite is the primary limiting factor - this is not remotely exploitable by anonymous or low-privileged users, so the realistic threat model is an insider or a compromised privileged database account. Affected builds are MySQL Server 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1 and MySQL Cluster 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; impact is confined to availability (service hang or repeatable crash) with no confidentiality or integrity effect.

This is a medium-severity, low-real-world-priority issue despite affecting ubiquitous software. The vendor-assigned CVSS 3.1 score is 4.9 with the vector AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H: network-reachable and low-complexity, but gated behind PR:H (high privileges) and limited strictly to availability (C:N/I:N) - the only outcome is a hang or repeatable crash (complete DoS) of the database. The high-privilege requirement is the dominant mitigating signal: an attacker must already hold elevated MySQL credentials, meaning the realistic threat is a trusted-but-malicious or compromised privileged account rather than an external, unauthenticated adversary. No EPSS score was provided in the input, so exploitation probability cannot be quantified. The CVE is not listed in CISA KEV and no public exploit code was referenced, so there is no public exploit identified at time of analysis. No SSVC decision data was supplied. The signals are internally consistent (no contradiction between CVSS vector and description - both agree on network vector, high privilege, availability-only impact), so the main uncertainty is the absence of EPSS/KEV/POC data rather than conflicting data. Bottom line: a credentialed denial-of-service bug worth patching in the normal Oracle quarterly cycle, not an emergency.

An attacker who already possesses high-privileged MySQL credentials (or has compromised such an account) connects over the network via one of the supported protocols and issues a specially crafted operation that triggers a flaw in the InnoDB storage engine, causing the server to hang or crash repeatedly for a complete denial of service. No public exploit code was identified at time of analysis, and because confidentiality and integrity are unaffected, the impact is limited to availability/downtime of the database.