MySQL Server CVE-2026-101778

Exploitation requires a valid low-privilege MySQL account (PR:L) reachable over the network via one of MySQL's supported protocols; the flaw resides in the Server: Components Services component. There is no requirement for administrative privileges, user interaction, or a non-default configuration, which is why Oracle rates it 'easily exploitable.' The principal limiting factor is authentication: the attacker must already possess working database credentials, so the realistic exposure is multi-tenant/shared database deployments, internet-reachable instances with weak or widely-shared accounts, or an attacker who has already compromised an application service account. Impact is confined to availability (complete DOS); no data disclosure or modification is possible. Affected: MySQL Server 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1 and MySQL Cluster 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1.

This is a moderate-severity availability-only flaw. The official CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) indicates a network-reachable, low-complexity attack requiring only low privileges (PR:L - an authenticated database account) and no user interaction, yielding a complete denial of service (hang or repeatable crash) with zero confidentiality or integrity impact. Oracle's own description rates it 'easily exploitable,' which is consistent with AC:L. However, no EPSS score, no CISA KEV listing, and no public POC were provided in the intelligence, and the vulnerability is not listed as actively exploited. The signals are therefore internally consistent (no conflict between vector and description) but point to a bounded risk: this is a real patch-priority item for internet-exposed or multi-tenant MySQL instances where untrusted users hold database credentials, but it is NOT a critical remote-code or data-breach issue. The requirement for valid low-privilege credentials meaningfully limits the exploit population versus a PR:N flaw. Treat as medium priority - patch in the normal Oracle CPU cycle, prioritizing shared/hosted database environments.

An attacker who already holds a low-privilege MySQL account (e.g., a tenant in a shared hosting or multi-tenant database, or a compromised application service account) connects over the network via a supported MySQL protocol and issues crafted input to the Server Components Services component, causing the server to hang or repeatedly crash and denying service to all users. No public exploit code has been identified at time of analysis, and the attack requires authentication but no user interaction and low complexity.