MySQL Server CVE-2026-101766

Exploitation targets the Server: Replication component and requires the attacker to already hold high MySQL privileges (PR:H) with network access over one of multiple supported protocols. Limiting factors are significant: the attacker must be authenticated as a high-privileged user before exploitation, and Oracle explicitly rates the flaw as 'difficult to exploit' (AC:H), implying specific timing, state, or configuration conditions must be met. No end-user interaction is needed (UI:N), and the only outcome is a hang or repeatable crash (complete DoS) - there is no data exposure or modification. Affected deployments are MySQL Server 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1 and MySQL Cluster 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1.

This is a genuinely low-priority issue despite its network attack vector. The CVSS 3.1 base score of 4.4 (MEDIUM) accurately reflects a constrained threat: the vector AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H shows that exploitation requires high privileges (PR:H) already on the target and has high attack complexity (AC:H), while the only impact is availability (A:H) - a hang or repeatable crash, with no confidentiality or integrity loss. No EPSS score was provided in the input, so exploitation probability cannot be quantified. The CVE is NOT listed in CISA KEV and no public exploit code is referenced, so there is no public exploit identified at time of analysis. The signals are consistent rather than conflicting: a high-complexity, high-privilege, availability-only flaw reported through Oracle's routine quarterly Critical Patch Update is the profile of a low real-world risk rather than an urgent priority. An attacker who already holds high MySQL privileges can generally cause disruption by other means, further reducing the marginal risk this adds.

An attacker who has already obtained high-privilege database credentials connects to MySQL Server or Cluster over the network via one of multiple supported protocols and sends crafted input to the Replication component, triggering a server hang or a reliably repeatable crash (complete DoS). The high attack complexity means specific timing or conditions must be met, and no public proof-of-concept is known, so successful exploitation is non-trivial.