MySQL Server CVE-2026-101726

Exploitation requires an authenticated MySQL account with at least low-level privileges (PR:L) and network reachability to the server over one of the supported MySQL protocols; it targets the C API component of affected MySQL Server (8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1) and MySQL Cluster (8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1) builds. No user interaction and no special non-default configuration are required per the CVSS vector. The primary limiting factor is the authentication requirement: an attacker must already hold valid, even if minimally privileged, database credentials, so instances that restrict network exposure and limit low-trust accounts face substantially lower real-world risk. Impact is confined to availability (service hang or complete crash); no data is read or altered.

This is a moderate-priority availability vulnerability, not a critical one. The CVSS 3.1 base score of 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) reflects a network-reachable, low-complexity flaw requiring only low-level privileges and no user interaction, with impact limited exclusively to availability (C:N/I:N/A:H) - a complete denial of service via hang or repeatable crash, with no data confidentiality or integrity exposure. Oracle characterizes it as 'easily exploitable,' which is consistent with AC:L. However, several key risk-amplifying signals are absent: there is no CISA KEV listing, no public proof-of-concept, and no EPSS score provided in the input, so there is no evidence of active or imminent widespread exploitation. The PR:L requirement meaningfully limits exposure - an attacker needs valid (even if minimally privileged) authenticated access to the database, so an authenticated-but-low-trust user or a compromised application credential is the realistic threat model, not an anonymous internet attacker. Net assessment: real but not urgent. Prioritize via Oracle's quarterly patching cycle rather than emergency out-of-band response, and give higher priority where MySQL instances are exposed to large pools of low-trust authenticated users (multi-tenant or shared-hosting deployments). No conflicting signals were detected between the CVSS vector and the description; both agree on network vector, low privilege, and availability-only impact.

An authenticated low-privileged user - or an attacker who has obtained a limited MySQL account through credential theft or a compromised application - connects over the network via one of the supported protocols and sends crafted input that exercises a defect in the C API component, causing the server to hang or repeatedly crash and producing a complete denial of service. Because privileges required are low and attack complexity is low, exploitation is straightforward once network and credential access exist, though no public exploit code has been identified at time of analysis.