Oracle MySQL CVE-2026-101754

Exploitation requires the attacker to already hold HIGH database privileges on the target (PR:H) and network reachability to MySQL Server or MySQL Cluster over one of multiple supported protocols (AV:N). Oracle classifies the attack as 'difficult to exploit' (AC:H), implying reliance on specific timing, state, or conditions rather than a deterministic trigger. No user interaction is needed (UI:N). The impact is strictly availability (A:H) - a hang or repeatable crash - with no data exposure or modification. Limiting factors that reduce real-world risk: the high-privilege prerequisite confines the threat largely to trusted/insider or already-compromised privileged accounts, and the high complexity lowers reliability. Affected versions are MySQL Server 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1 and MySQL Cluster 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1.

This is a low-priority vulnerability despite affecting an ubiquitous product. The CVSS 3.1 base score is 4.4 (Medium), and every signal points to constrained real-world risk. The vector (AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H) combines high attack complexity (AC:H) with a high-privilege requirement (PR:H), and Oracle's own description explicitly calls it 'difficult to exploit' requiring a 'high privileged attacker.' Impact is limited to availability (A:H) - a hang or repeatable crash (complete DoS) - with no confidentiality or integrity impact (C:N/I:N). No EPSS score was provided in the input, so exploitation probability cannot be quantified. There is no public exploit identified at time of analysis and the CVE is not in CISA KEV. No SSVC decision data was supplied. The combination of PR:H + AC:H means an attacker must already hold high database privileges, so the realistic threat is a privileged insider or an already-compromised high-privilege account causing denial of service - not mass remote exploitation. Note the component is listed as 'Client programs' yet the CVSS vector is AV:N with impact on the Server/Cluster; this is consistent with Oracle's convention of scoring server impact via client-facing interaction, but the exact attack surface should be verified against the Oracle CPU advisory.

An attacker who already possesses high database privileges connects to MySQL Server or Cluster over the network via one of multiple supported protocols and issues a specially crafted sequence through a client program interaction that triggers a server-side fault. The result is a hang or repeatedly reproducible crash, denying service to all users until the instance is restarted. No public proof-of-concept is known, and the high complexity (AC:H) means exploitation is not trivially reliable.