MySQL Server CVE-2026-101749

Exploitation requires the attacker to already hold a HIGH-PRIVILEGED MySQL account (PR:H) - this is the primary limiting factor and means the flaw is reachable only by trusted administrative users or an attacker who has first compromised such credentials. The attack targets the Server's Security: Encryption component and is reachable remotely over the network via multiple supported MySQL protocols (AV:N), with low complexity once the privilege prerequisite is met (AC:L) and no user interaction (UI:N). There are no special non-default configuration requirements named in the description, but the high-privilege gate confines realistic exploitation to insiders or post-compromise scenarios rather than anonymous internet attackers. Impact is limited strictly to availability (hang/repeatable crash); no confidentiality or integrity effect applies.

This is a genuine-but-moderate-priority issue, not a top-tier emergency. The CVSS 3.1 score of 4.9 (Medium) is driven entirely by availability impact (A:H, with C:N/I:N) - the only consequence is a hang or repeatable crash producing a complete denial of service of MySQL Server/Cluster. The vector shows network reachability (AV:N) and low attack complexity (AC:L), but critically requires high privileges (PR:H), meaning the attacker must already hold an administrative/high-privileged database account. That single factor sharply limits real-world exploitability: a trusted, highly-privileged insider or an attacker who has already compromised admin credentials is the realistic threat model, not an anonymous remote attacker. No EPSS score was provided in the input, so exploitation probability cannot be quantified. This CVE is NOT listed in CISA KEV and no public exploit (POC) is referenced, so there is no public exploit identified at time of analysis - do not treat it as actively exploited. The signals are internally consistent (DOS-only description matches A:H/C:N/I:N and the PR:H gate matches 'high privileged attacker'); there is no conflict between the description and the vector. Bottom line: prioritize patching in regular Oracle CPU cycles rather than as an out-of-band emergency, since the privilege requirement and availability-only impact keep real-world risk modest.

An attacker who already possesses a high-privileged MySQL account (e.g., a malicious insider or an actor who has stolen admin credentials) connects over the network via one of the supported protocols and issues crafted operations against the Server's encryption/security component, causing the server to hang or repeatedly crash. This yields a complete denial of service for MySQL Server/MySQL Cluster but no data disclosure or modification. No public exploit code is referenced, so exploitation would require the attacker to independently develop the trigger.