Oracle MySQL CVE-2026-101777

Exploitation requires the attacker to already hold a high-privilege MySQL account (PR:H) and network access to the MySQL Server/Cluster via one of its supported protocols; the flaw resides specifically in the Server: Security: Encryption component. Limiting factors that reduce realistic risk: the high-privilege prerequisite excludes anonymous or low-privileged remote attackers, so this primarily matters for insider abuse or scenarios where a privileged DB credential has been compromised. Affected deployments are limited to MySQL Server/Cluster versions 9.7.0-9.7.3 and 26.7.0-26.7.1; no user interaction is required (UI:N) and attack complexity is low (AC:L) once privileged access exists.

This is a moderate-severity issue (Oracle-assigned CVSS 3.1 base 5.5) whose real-world priority is constrained chiefly by the PR:H privilege requirement. The vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:H combines network reachability and low attack complexity with a demand for high privileges, meaning the attacker must already hold a strongly privileged MySQL account before the flaw can be triggered - this is the dominant limiting factor and sharply narrows the threat population from 'any remote attacker' to 'already-trusted/compromised high-privilege DB users or insiders.' The dominant technical impact is availability (A:H: complete hang or repeatable crash / DOS) plus limited confidentiality (C:L: read access to a subset of data); there is no integrity impact (I:N). No EPSS score, SSVC decision, KEV listing, or POC indicator was supplied in the input: there is no public exploit identified at time of analysis and no evidence of active exploitation. Note a mild internal tension worth flagging: Oracle's text calls this 'easily exploitable' (consistent with AC:L) yet also requires high privileges (PR:H), so 'easy' applies only once privileged access is held - do not read 'easily exploitable' as 'low barrier to entry.' Overall this is a legitimate patch-in-normal-cycle item (hardening against privileged abuse and insider/credential-compromise scenarios) rather than an emergency, high-urgency remote vulnerability.

An attacker who already possesses a high-privilege MySQL account (e.g., via credential theft, a malicious insider, or a compromised application service account) connects over the network using one of the supported MySQL protocols and sends crafted input to the Server's encryption/security subsystem. The result is a hang or repeatable crash producing a complete denial of service, alongside limited unauthorized read access to a subset of database data. No public proof-of-concept was identified in the provided data, and low attack complexity (AC:L) means the action is reliable once the privileged session is established.