Oracle MySQL Server CVE-2026-101751

Exploitation requires the affected MySQL Server or MySQL Cluster to be running with Group Replication enabled, since the flaw is in the Server: Group Replication GCS (Group Communication System) component - standalone MySQL instances without Group Replication are not in the vulnerable code path. The attacker must hold HIGH MySQL privileges (CVSS PR:H), so this is not remote-unauthenticated: it demands an administrative/high-privilege account or its compromise. Attack is over the network via multiple protocols with low complexity and no user interaction, but the high-privilege and Group-Replication-configuration prerequisites are the key limiting factors that confine realistic risk to privileged insiders, stolen admin credentials, or multi-tenant clustered environments. Affected versions: MySQL Server 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1.

This is a genuine but relatively low-priority availability-only flaw, not a high-severity emergency. The CVSS 3.1 base score is 4.9 (Medium), and the vector (AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H) tells a coherent story: it is network-reachable with low attack complexity, but critically requires HIGH privileges (PR:H) and yields no confidentiality or integrity impact - only a complete denial of service (hang or repeatable crash). The PR:H requirement is the dominant limiting factor: an attacker must already hold high-level/administrative MySQL privileges, which sharply narrows the realistic threat to insiders, compromised admin credentials, or chained post-authentication abuse rather than opportunistic external attackers. No EPSS score, CISA KEV listing, SSVC decision data, or POC availability was provided in the input; per precision rules this is treated as 'no public exploit identified at time of analysis.' There is no conflict between the CVSS vector and the description - both agree on network access, high privilege, and availability-only impact. The one nuance worth flagging: Oracle labels this 'easily exploitable,' but 'easily' refers to the low attack complexity (AC:L) once the high-privilege precondition is met, not to ease of obtaining that privilege. Overall this is a patch-in-normal-cycle issue for most operators, with elevated attention warranted only for multi-tenant or Group-Replication clustered deployments where privileged-but-untrusted actors exist.

An attacker who already possesses high MySQL privileges (e.g., a malicious or compromised database administrator account) in a deployment using Group Replication sends crafted traffic over MySQL's network protocols to the Group Communication System (GCS) component, triggering a hang or repeatable crash that takes the server or cluster offline. No public exploit code was identified in the provided data, and the attack produces only denial of service - no data disclosure or modification.