Oracle MySQL CVE-2026-101771

Exploitation targets MySQL/MySQL Cluster 'Client programs,' not the server daemon, so the attacker must get a MySQL client to communicate with an attacker-controlled, rogue, or machine-in-the-middle MySQL server over one of the 'multiple protocols' the client speaks; this prerequisite is precisely why Oracle rates it AC:H ('difficult to exploit'). No authentication is required (PR:N) and no user interaction is encoded in the vector (UI:N), but in practice a client connection to the malicious endpoint must occur. Limiting factors: the attacker needs network positioning to impersonate or intercept a server, the high attack complexity implies non-trivial timing/configuration conditions, and affected scope is bounded to the specific MySQL Server/Cluster versions listed (Server 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; Cluster additionally 8.0.0-8.0.49).

This is a genuinely serious flaw on paper - CVSS 3.1 base score 8.1 with full Confidentiality, Integrity, and Availability impact (C:H/I:H/A:H) and an unauthenticated network vector (AV:N/PR:N/UI:N) resulting in product takeover. However, the single most important mitigating signal is AC:H ('Difficult to exploit vulnerability' per Oracle's own wording), which materially lowers real-world likelihood. Critically, the affected component is 'Client programs,' not the server listener - so despite the 'takeover of MySQL Server, MySQL Cluster' phrasing, the realistic attack is against the connecting client/tooling and typically requires the victim to connect to an attacker-controlled or MITM'd server, which is what the high attack complexity reflects. No EPSS score, no CISA KEV listing, and no public POC are present in the provided data, so there is no evidence of active exploitation; exploitation status is 'no public exploit identified at time of analysis.' Signals are therefore consistent rather than conflicting: high theoretical impact but high complexity and no exploitation evidence point to a patch-in-normal-cycle priority rather than an emergency. Note the input 'Information Disclosure' tag understates the vector - the CVSS shows full I and A impact, not merely disclosure - so defenders should not treat this as read-only. No CWE was provided, and the specific vulnerable protocol/parsing path is not disclosed in the Oracle CPU entry.

An attacker who controls or can machine-in-the-middle a MySQL server endpoint lures a MySQL client program (CLI, connector, or admin tooling) into connecting to it, then returns a crafted malicious response over one of multiple supported protocols. Because the flaw is difficult to exploit (AC:H), the attacker must satisfy specific protocol/timing conditions, but success yields full compromise of the client-side MySQL component. No authentication is required (PR:N) and no public exploit code was identified at the time of analysis.