MySQL Server CVE-2026-101772

Exploitation targets the MySQL Server/Cluster 'Client programs' component and requires network reachability to the vulnerable client/protocol endpoint over any of 'multiple protocols' (per Oracle). No authentication is required (PR:N) and no user interaction is required (UI:N). The key LIMITING factor is high attack complexity (AC:H): Oracle explicitly labels it 'difficult to exploit', meaning the attacker must satisfy a condition outside their control - plausibly controlling the peer endpoint (e.g., a malicious MySQL server a client connects to) or winning a timing/protocol race. Affected versions are precisely bounded: MySQL Server 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1 and MySQL Cluster 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; deployments outside these ranges or already on the October 2026 CPU fix are not exposed.

This is a high-severity (CVSS 3.1 8.1) vulnerability in MySQL Server/Cluster client programs that Oracle states allows an unauthenticated network attacker to fully take over the affected product (C:H/I:H/A:H). The single most important mitigating signal is AC:H ('Difficult to exploit vulnerability'), which indicates the attacker needs conditions outside their control - likely a race, a specific protocol negotiation, or coercing a client to connect to a malicious server. No EPSS score, SSVC decision, KEV listing, or POC was provided, so exploitation probability cannot be quantified from the input; there is no public exploit identified at time of analysis. On balance this is a genuine high-priority patching item for any internet-reachable or multi-tenant MySQL deployment because of the unauthenticated network vector and total-compromise impact, but the AC:H complexity and absence of any exploitation evidence (no KEV, no POC, no EPSS) suggest it is not under active mass exploitation today. Note a conflict worth flagging to the vendor: the component is 'Client programs' and the tag is 'Information Disclosure', yet Oracle describes full takeover with C:H/I:H/A:H and 'multiple protocols' - verify whether the real attack is a malicious/compromised MySQL server attacking connecting clients rather than a direct server compromise.

An attacker with network access induces a vulnerable MySQL client program to communicate over one of several supported protocols and exploits a flaw triggered during that exchange to achieve full compromise of the MySQL Server/Cluster component without authentication. Because the CVSS marks AC:H, the attacker must win a difficult-to-arrange condition (e.g., a timing window or control of the peer endpoint such as a rogue server). No public proof-of-concept is identified at time of analysis.