Oracle MySQL CVE-2026-101729

Exploitation targets the MySQL Server/Cluster Replication component and requires a high-privileged database account (CVSS PR:H) reachable over the network via one of the supported protocols; no user interaction is needed. The limiting factors are substantial: the attacker must already possess elevated MySQL privileges, so this is effectively an authenticated, privileged-insider or post-credential-compromise condition rather than an anonymous remote attack. Affected deployments are MySQL Server 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1 and MySQL Cluster 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; environments that tightly restrict high-privilege accounts and network exposure to trusted hosts materially reduce exposure.

This is a moderate-severity, availability-only vulnerability (CVSS 3.1 base 4.9, vector AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). The signals converge on a LOW real-world priority despite the network attack vector. The decisive limiting factor is PR:H: exploitation requires an already high-privileged account on the MySQL Server/Cluster, which dramatically narrows the realistic attacker population to insiders or an adversary who has already compromised privileged credentials. Impact is confined to availability (A:H, C:N/I:N) - a hang or repeatable crash (complete DOS) of the database, with no data confidentiality or integrity loss. No EPSS score, KEV listing, or POC was provided in the input, so there is no evidence of active exploitation or public exploit tooling. The 'easily exploitable' wording from Oracle (reflected in AC:L) is in tension with the high-privilege precondition - it is easy only for someone who already holds elevated database privileges. Net: a genuine but low-urgency patch item, not an emergency; prioritize via normal Oracle CPU patch cycles rather than out-of-band response. Note: CWE is listed as N/A and no EPSS/KEV data was supplied, so exploitation-probability signals are absent rather than low.

An attacker who already holds a high-privileged MySQL account (or has compromised such credentials) connects over the network via one of the supported protocols and issues crafted input to the Replication component, causing the server to hang or repeatedly crash, producing a complete denial of service of the MySQL Server or Cluster. No public exploit code was identified in the provided data, and no user interaction is required. The attack yields only downtime - no data theft or modification.