MySQL Server CVE-2026-101623

Exploitation requires the attacker to already hold high MySQL privileges (PR:H) on the target MySQL Server or MySQL Cluster instance and network reachability to the database over one of its supported protocols; no user interaction is needed. The triggering input is a crafted query processed by the Server Optimizer component. The key limiting factor is the high-privilege prerequisite - a low-privileged or unauthenticated user cannot exploit this - which substantially narrows the realistic attacker set to insiders or anyone who has already compromised a privileged database account. Affected versions are MySQL Server 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1 and MySQL Cluster 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1.

This is a genuinely moderate, not high-priority, issue. The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H, base 4.9) tells a consistent story with Oracle's description: network-reachable and low-complexity, but gated behind PR:H - the attacker must already hold high database privileges. Impact is availability-only (C:N/I:N) resulting in a hang or repeatable crash (complete DoS of the affected instance), with no confidentiality or integrity loss and no scope change. No EPSS score, CISA KEV listing, POC, or SSVC decision point was provided in the input, so there is no signal of active or likely exploitation - the risk is bounded by the fact that an attacker possessing high MySQL privileges can already cause substantial disruption by other means, which limits the marginal value of this flaw. No signals conflict: the description's 'high privileged attacker with network access' aligns cleanly with PR:H/AV:N. Net: a real but lower-tier availability bug best handled on normal Oracle CPU patching cadence rather than as an emergency.

An attacker who has already obtained high-privilege credentials on a MySQL Server or Cluster node connects over the network via a supported protocol and issues a specially crafted query that drives the Optimizer into a fault condition. The server hangs or crashes repeatably, producing a complete denial of service for the database instance. No public exploit code was identified in the provided data.