MySQL Server CVE-2026-101621

Exploitation requires the attacker to hold a HIGH-privileged MySQL account (PR:H confirmed by the CVSS vector), so this is an authenticated attack reachable over the network via multiple MySQL protocols against MySQL Server or MySQL Cluster running the affected InnoDB component. Affected builds are MySQL Server 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1 and MySQL Cluster 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1. The primary limiting factor is the high privilege prerequisite; no user interaction is needed (UI:N) and attack complexity is low (AC:L), but the impact is confined to availability (service hang or repeatable crash) with no confidentiality or integrity consequence.

This is a genuinely moderate-to-low priority issue despite affecting a ubiquitous database platform. The CVSS 3.1 base score of 4.9 (MEDIUM) is driven purely by an availability impact (A:H) with no confidentiality or integrity consequence (C:N/I:N). The vector (AV:N/AC:L/PR:H/UI:N/S:U) shows that while the attack is network-reachable and low-complexity, it requires HIGH privileges (PR:H) - the attacker must already hold a privileged MySQL account, which substantially narrows the realistic threat population to authenticated insiders or attackers who have already compromised privileged credentials. No EPSS score was provided in the input, and there is no CISA KEV listing and no public proof-of-concept identified at time of analysis, so there is no evidence of active or imminent widespread exploitation. The only outcome is a hang or repeatable crash (complete DoS) of the server/cluster; there is no path to data exposure or code execution. Net assessment: a real but bounded availability risk best handled via normal Oracle quarterly CPU patch cycles rather than emergency response. Note the Oracle phrasing 'Easily exploitable' refers to attack complexity (AC:L) and should not be conflated with low privilege requirements - the PR:H gate remains the key limiting factor.

An attacker who already possesses a high-privileged MySQL account (or has compromised such credentials) connects over the network via one of MySQL's supported protocols and issues a crafted request that triggers a fault in the InnoDB storage engine. The result is a server hang or a repeatable crash, producing a complete denial of service for the MySQL Server or Cluster. No public exploit code has been identified at time of analysis, and the required high privilege level makes opportunistic external exploitation unlikely.