MySQL Server CVE-2026-101779

Exploitation requires an attacker to already hold HIGH database privileges on the target (PR:H), reached over the network via one of MySQL's supported protocols (AV:N), with no user interaction. The specific prerequisite is privileged access that can reach the 'Server: Telemetry' component; there is no evidence the flaw is reachable by unauthenticated or low-privileged users. The limiting factors are substantial: the high-privilege requirement confines realistic exploitation to insiders or attackers who have already compromised a privileged account, and the maximum impact is only a PARTIAL denial of service with no data exposure or modification. Affected versions are MySQL Server/Cluster 8.4.0-8.4.12, 9.7.0-9.7.3, and 26.7.0-26.7.1.

This is a low-severity, low-real-world-priority issue despite affecting a ubiquitous product. The CVSS 3.1 base score is only 2.7 with vector AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L - network vector and low complexity are offset by the requirement for HIGH privileges (PR:H) and the impact being limited to a PARTIAL availability loss (A:L) with no confidentiality or integrity impact. No EPSS score was provided in the input, and the issue is NOT listed in CISA KEV; no public exploit (POC) is referenced. No SSVC decision data was supplied. The dominant limiting signal is PR:H: an attacker must already hold high database privileges, which drastically narrows the realistic threat to insiders or already-compromised privileged accounts rather than opportunistic remote attackers. The only elevating factor is the ubiquity of MySQL, but even so the achievable outcome (partial DoS) is minor. Oracle's own phrasing calls it 'easily exploitable' yet still scores it 2.7, consistent with the high-privilege prerequisite capping overall risk. No signals are in conflict here - every available indicator points to low priority.

An attacker who already possesses high-privilege credentials on a MySQL Server or MySQL Cluster instance connects over the network via one of the supported protocols and abuses the Server: Telemetry component to trigger a partial denial of service, degrading or interrupting availability of the database service. No public exploit code is referenced, and no confidentiality or integrity compromise is achievable. The attack is network-reachable but gated entirely by the need for pre-existing high privileges.