MySQL Server CVE-2026-101624

Exploitation requires an authenticated session holding HIGH MySQL privileges (CVSS PR:H) against an affected version - MySQL Server 8.4.0-8.4.12, 9.7.0-9.7.3, or 26.7.0-26.7.1, or MySQL Cluster 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3, or 26.7.0-26.7.1 - reachable over the network via one of MySQL's supported protocols. No user interaction is needed (UI:N) and attack complexity is low (AC:L) once privileged. The decisive limiting factor is the high-privilege prerequisite: the attacker must already be a trusted/privileged database account, so risk concentrates in multi-tenant or shared-DBA environments where high-privilege access is delegated to untrusted parties. The only impact is availability (database hang or repeatable crash); no confidentiality or integrity effect applies.

This is a moderate-severity, availability-only vulnerability that scores CVSS 3.1 4.9 (vendor-assigned via Oracle's October 2026 CPU). The vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H tells a clear and self-consistent story: network-reachable and low-complexity, but gated behind PR:H - the attacker must already hold high database privileges. Impact is confined to availability (C:N/I:N), producing a hang or repeatable crash (complete DoS of the database instance) with no data disclosure or integrity loss. No EPSS score, CISA KEV listing, or public POC was provided in the intelligence set, and the only reference is Oracle's CPU advisory plus the NVD mirror. Weighing these signals together, this is NOT a drop-everything priority: the PR:H requirement means the actor is effectively a malicious or compromised privileged account, which sharply narrows the realistic threat population and makes mass, unauthenticated exploitation impossible. The description's 'easily exploitable' phrasing (Oracle boilerplate) refers to low attack complexity once privileged, and should not be read as low barrier to entry - the privilege prerequisite is the dominant limiting factor. Treat this as a routine patch-cycle item rather than an emergency, higher where untrusted users hold legitimate high-privilege MySQL accounts.

A user who already holds high MySQL privileges (e.g., a tenant DBA on a shared/multi-tenant database, or an attacker who has compromised such an account) connects over the network via a supported protocol and issues a crafted request that drives the InnoDB engine into a hang or repeatable crash, taking the server offline for all other users. No public exploit code was identified at time of analysis, and because confidentiality and integrity are untouched the attacker gains only denial of service, not data access.