Oracle MySQL CVE-2026-101728

Exploitation requires a valid low-privileged MySQL account (CVSS PR:L) with network reachability to the database over one of its supported protocols; the vulnerable code lies in the Server: Pluggable Auth component, so the attack exercises the server's authentication plugin handling. No user interaction is needed (UI:N) and the attack is of low complexity (AC:L), so any authenticated user - including untrusted application or tenant credentials - can trigger it against default configurations. Limiting factors: the attacker must already authenticate (this is not pre-auth/unauthenticated), impact is confined to availability (no data read or modification), and only the listed MySQL Server versions (8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1) and MySQL Cluster versions (8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1) are affected.

This is a medium-severity availability-only flaw (CVSS 3.1 6.5, AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) in the Server: Pluggable Auth component of Oracle MySQL Server and MySQL Cluster. The CVSS signals are internally consistent and point to an easily-exploitable, network-reachable denial-of-service: low attack complexity and no user interaction, but PR:L means a valid (low-privileged) database account is required, which meaningfully narrows the attacker population versus a pre-auth bug. Impact is limited strictly to availability (C:N/I:N) - a hang or repeatable crash producing complete DoS - with no data disclosure or integrity loss. No EPSS score was supplied in the input, there is no CISA KEV listing, and no public exploit was referenced, so there is no evidence of active or widespread exploitation: this reads as a patch-in-normal-cycle issue rather than an emergency. The practical priority is driven almost entirely by MySQL's enormous deployment footprint and the fact that any authenticated user - including low-trust application or tenant accounts - could crash the server, which matters most for multi-tenant or internet-adjacent database tiers. Oracle is the sole source; independent corroboration (CWE, EPSS, POC) is absent.

An attacker who already holds a low-privileged MySQL account - for example a limited application or tenant user, or a credential obtained via reuse - connects to the server over one of its supported network protocols and sends crafted input that exercises the pluggable authentication code path. This triggers a hang or repeatable crash, taking the MySQL Server or Cluster node fully offline (complete DoS). No public exploit code was identified at time of analysis, and the attack requires valid authentication (PR:L) but no user interaction.