MySQL Server CVE-2026-101627

Exploitation requires an authenticated attacker holding a HIGH-privilege MySQL account (PR:H) with network access to the server over one of multiple supported MySQL protocols. The flaw resides in the InnoDB storage engine, so an InnoDB-backed deployment is implicitly required (the default storage engine). The high attack complexity (AC:H) indicates success depends on conditions the attacker cannot fully control - likely specific timing, server state, or data conditions - making reliable exploitation difficult. No user interaction is needed (UI:N). Limiting factors: the high privilege requirement substantially narrows the viable attacker set to insiders or already-compromised privileged accounts, and the impact is confined to availability (hang/crash) with no data disclosure or modification.

This is a genuinely low-priority issue despite affecting a ubiquitous product. The CVSS 3.1 base score of 4.4 (Medium) is driven entirely by availability impact (A:H), with no confidentiality or integrity impact. Critically, the vector requires high attack complexity (AC:H) and high privileges (PR:H), meaning the attacker must already hold a privileged MySQL account AND overcome conditions outside their control. Oracle itself characterizes it as 'difficult to exploit.' No EPSS score, KEV listing, or public POC is present in the provided data, so there is no evidence of exploitation interest: exploitation status is 'no public exploit identified at time of analysis.' The signals are internally consistent - there is no conflict between the network attack vector (AV:N) and the description, which confirms network access via multiple protocols. The combination of high privilege requirement, high complexity, and DoS-only impact means a privileged insider or compromised service account could at most crash/hang the server, not escalate or exfiltrate. This is a 'patch in the normal Oracle CPU cycle' issue, not an emergency.

An attacker who already holds a high-privileged MySQL account (e.g., a compromised application service account or malicious DBA) connects over the network via a supported protocol and submits a specially crafted sequence of operations that trigger a flaw in the InnoDB storage engine. The result is a hang or repeatable crash producing a complete denial of service for the MySQL Server/Cluster. No public exploit code is known, and the high attack complexity means success is not reliably reproducible by a low-skill actor.