MySQL Server CVE-2026-101748

Exploitation requires the attacker to hold a valid low-privileged MySQL account (PR:L) and network reachability to the database listener over one of its supported protocols; no user interaction or elevated privileges are needed. The flaw is in the Server Security/Audit subsystem, so instances with audit functionality in use are the relevant attack surface. Affected builds are specifically MySQL Server 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1 and MySQL Cluster 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1 - deployments outside these version ranges are not affected. The principal limiting factor is the authentication requirement: an attacker must already possess credentials, so exposure is highest where untrusted or shared application accounts can reach the server. Impact is confined to availability (service crash/hang); no data is read or altered.

This is a moderate-priority availability flaw, not a critical breach risk. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, base 6.5) confirms a network-reachable, low-complexity attack requiring only low privileges and no user interaction, but the impact is strictly availability - zero confidentiality or integrity loss. The Oracle description reinforces this as a complete DOS (hang or repeatable crash) with no data exposure. No EPSS score, KEV listing, or POC was supplied in the intelligence, so exploitation likelihood cannot be quantified from the data; absence of these is not evidence of safety but does mean there is no confirmed active exploitation. The 'easily exploitable' wording from Oracle aligns with AC:L, and PR:L means any authenticated database account (even an unprivileged one) suffices - a realistic concern in multi-tenant or application-shared database environments. Net: real but bounded risk, worth prompt patching in internet-adjacent or multi-user deployments, below the urgency of a code-execution or data-disclosure bug.

A low-privileged attacker holding any valid MySQL account connects over the network via one of the supported protocols and sends crafted input to the Server Security/Audit component, triggering a hang or repeatable crash that takes the database offline. Because attack complexity is low and no user interaction is needed, the action can be scripted and repeated to sustain a denial of service. No public exploit code was identified in the provided data.