Oracle MySQL CVE-2026-101637

Exploitation requires an authenticated attacker holding HIGH database privileges (PR:H) - effectively a DBA/administrative-level MySQL account - with network access to the server over one of MySQL's supported protocols. No end-user interaction is required (UI:N) and no special non-default configuration is called out in the description; the flaw resides in the core InnoDB storage engine, which is the default and near-universal engine, so default deployments of the affected versions are in scope. The decisive limiting factor is the high-privilege prerequisite, which restricts realistic exploitation to malicious insiders or attackers who have already obtained privileged credentials. Affected: MySQL Server and MySQL Cluster 9.7.0-9.7.3 and 26.7.0-26.7.1.

This is a moderate-priority issue, not a top-tier emergency. The CVSS 3.1 base score of 5.5 (MEDIUM) reflects the key limiting factor: PR:H means the attacker must already hold high database privileges (effectively an administrative/DBA-level account) before exploitation. The vector is AV:N/AC:L (network-reachable, low complexity) and UI:N, so once an attacker has those privileges the attack is trivial to carry out over MySQL's standard protocols, but the privilege barrier sharply narrows the realistic threat to malicious insiders or attackers who have already compromised a privileged account. Impact is A:H (complete DOS via hang or repeatable crash) plus I:L (partial unauthorized update/insert/delete), with C:N (no data disclosure). On exploitation signals: there is no EPSS score, no CISA KEV listing, and no public POC referenced - so there is no evidence of active exploitation or widespread weaponization. The only signals present (Oracle CPU advisory, 'Denial Of Service' tag) are consistent with a vendor-reported, patch-at-next-cycle item. No conflicting signals were found; the main caveat is simply that absent EPSS/KEV/POC data, exploitation likelihood is inferred from the vector alone. Prioritize patching in the next Oracle CPU cycle rather than as an out-of-band emergency, but note the insider-threat dimension: any environment where DBA credentials are shared or weakly controlled faces real DOS risk.

An attacker who already possesses high MySQL privileges (e.g., a rogue DBA, or an external attacker who has stolen or compromised an administrative database account) connects to the server over a standard MySQL protocol and submits crafted input that triggers the InnoDB flaw. This causes the server to hang or repeatedly crash (complete denial of service) and allows limited unauthorized modification of some accessible data. No public exploit code has been identified at time of analysis.