MySQL Server CVE-2026-101752

Exploitation requires the attacker to already possess a high-privilege account on the target MySQL Server or MySQL Cluster (PR:H) and network reachability to the database over one of its supported protocols; the flaw resides in the Server: Components Services component. Exploitation is further limited by high attack complexity (AC:H), implying a non-deterministic or timing/condition-dependent trigger that is not reliably repeatable on demand. Affected builds are MySQL Server and MySQL Cluster 9.7.0-9.7.3 and 26.7.0-26.7.1; instances on other versions or already patched per Oracle CPU October 2026 are not exposed. No end-user interaction is required (UI:N), but the privileged-authentication requirement is the primary factor constraining realistic exploitation.

This is a low-to-moderate priority issue despite its Oracle-sourced severity. The CVSS 3.1 base score of 4.4 (MEDIUM) reflects a narrow, availability-only impact: the vector AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H shows that while the attack is over the network, it is Difficult to exploit (AC:H) and - critically - requires High privileges (PR:H), meaning the attacker must already hold a privileged MySQL account. There is no confidentiality or integrity impact; the sole consequence is a hang or repeatable crash (complete DoS). No EPSS score, KEV listing, or POC was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The combination of high required privileges, high attack complexity, and availability-only impact means the real-world risk is modest: an attacker capable of triggering this already has privileged database access, limiting the marginal damage to denial of service. The high-privilege precondition is the dominant mitigating signal and places this well below internet-facing, unauthenticated flaws in triage order.

An attacker who has already obtained high-privilege credentials on a MySQL Server or Cluster instance connects over the network via one of multiple supported protocols and issues specially crafted operations against the Server Components Services component, causing the server to hang or repeatedly crash and producing a complete denial of service. The high attack complexity means the condition is not trivially reliable, and no public exploit code is known to exist. Because exploitation requires existing privileged access, the practical threat is primarily a malicious or compromised privileged insider.