Oracle MySQL Server CVE-2026-101724

Exploitation requires an authenticated account with HIGH database privileges (CVSS PR:H) on the target MySQL Server or MySQL Cluster instance, reachable over the network via one of MySQL's supported protocols. The key limiting factor is this elevated-privilege prerequisite: an attacker cannot exploit it from an unauthenticated or low-privilege position, which confines realistic risk to insiders, compromised admin/service credentials, or multi-tenant deployments where untrusted parties hold high DB privileges. No user interaction is required (UI:N) and attack complexity is low (AC:L). Affected: MySQL Server 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1.

This is a moderate-severity denial-of-service issue (CVSS 3.1 base 4.9) affecting Oracle MySQL Server and MySQL Cluster via the InnoDB component. The CVSS vector (AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H) shows network reach and low attack complexity, but PR:H means the attacker must already hold high database privileges - a significant barrier that caps real-world risk and is why the score sits below 5.0 despite network vector and 'easily exploitable' vendor phrasing. Impact is availability-only (A:H, complete DOS via hang or repeatable crash); there is no confidentiality or integrity impact (C:N/I:N). No EPSS score, CISA KEV listing, or public POC was provided in the input, so there is no signal of active or probable exploitation - this is no public exploit identified at time of analysis. Net: a real but low-priority bug for most defenders - patch in the normal Oracle CPU cycle rather than as an emergency, with the caveat that it matters more where untrusted or semi-trusted users hold elevated DB privileges (e.g., multi-tenant or hosting environments). Note: the input lists no EPSS and no KEV, so exploitation probability cannot be quantified from available data.

An attacker who already possesses a high-privilege MySQL account (or has compromised such credentials) connects over the network via one of the supported protocols and issues a crafted sequence of operations that trips a flaw in the InnoDB storage engine, causing the server to hang or crash repeatedly for a complete denial of service. No public exploit code is identified at the time of analysis. Low attack complexity (AC:L) means the triggering action is reliable once the privilege prerequisite is met.