MySQL Server CVE-2026-101618

Exploitation requires the attacker to already hold HIGH database privileges (CVSS PR:H) on the target MySQL Server or MySQL Cluster, and network reachability to the database over one of its supported protocols. The flaw resides in the InnoDB storage-engine component, so affected instances must be using InnoDB (the MySQL default). Affected builds are MySQL Server 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1 and MySQL Cluster 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1. The key LIMITING factor is the high-privilege precondition - this is not remotely exploitable by an unauthenticated or low-privileged user; it requires an already-trusted high-privilege account. Impact is confined to availability (complete DoS via hang/repeatable crash); there is no data disclosure or modification. No user interaction is required (UI:N).

This is a genuinely low-to-moderate priority issue despite affecting an ubiquitous product. The CVSS 3.1 base score of 4.9 (MEDIUM) accurately reflects the constrained impact: the vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H shows network reach and low attack complexity, but critically requires HIGH privileges (PR:H) and yields ONLY an availability impact (C:N/I:N/A:H) - a hang or repeatable crash (complete DoS), with no confidentiality or integrity loss. The PR:H requirement is the dominant limiting factor: an attacker must already possess high-level database privileges, meaning this is essentially an authenticated/insider or post-compromise denial-of-service rather than a remotely exploitable entry point. No EPSS score is provided in the input. The CVE is NOT listed in CISA KEV and no public POC is referenced, so there is no evidence of active exploitation or available exploit code. There is no conflict among the signals: a medium CVSS, absence of KEV/POC, DoS-only impact, and high-privilege precondition all consistently point to a low real-world urgency. The main caveat is data sparseness - the only references are the Oracle CPU October 2026 landing page and the NVD detail page, with no dedicated per-CVE advisory text beyond the standard Oracle description and no EPSS value to quantify exploitation likelihood.

An attacker who has already obtained high database privileges (e.g., a malicious insider or an account compromised earlier in a breach) connects to the MySQL Server or Cluster over the network via one of its supported protocols and issues specially crafted operations against the InnoDB storage engine. This triggers a hang or a frequently repeatable crash, producing a complete denial of service for the database. No public exploit code is identified at time of analysis, and because high privileges are required, the realistic scenario is abuse by a privileged/authenticated actor rather than opportunistic external attack.