MySQL Server CVE-2026-101781

Exploitation requires the target MySQL Server or MySQL Cluster to be running Group Replication (the vulnerable 'Server: Group Replication GCS' / Group Communication System component), which is used in high-availability clustered deployments and is not part of a standalone default install - this is the primary limiting factor. The attacker must also have access to the physical communication segment attached to the hardware where MySQL executes (AV:A, adjacent network / same L2 segment or replication VLAN), so remote internet-based exploitation is not possible. No authentication is required (PR:N), no user interaction is needed (UI:N), and attack complexity is low (AC:L), so any unauthenticated actor already on that replication segment can attempt it against affected versions (MySQL Server 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1).

CVSS 3.1 base score is 8.8 (High) with vector AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, indicating an adjacent-network, low-complexity, unauthenticated attack requiring no user interaction and yielding full confidentiality, integrity and availability loss ('takeover'). The decisive and often-overlooked signal here is AV:A (Adjacent), not AV:N: the attacker must sit on the same physical communication segment/L2 broadcast domain as the MySQL host, which materially narrows the attack surface compared to a true internet-facing flaw. No EPSS score, CISA KEV listing, SSVC decision data, or public POC is present in the provided intelligence, so exploitation is currently 'no public exploit identified at time of analysis'; there is no evidence of active exploitation. This should be treated as a genuine high-severity patch priority for clustered MySQL deployments that run Group Replication, but it is NOT an internet-wide spray threat - the adjacent-network constraint and the requirement that the Group Replication/GCS feature be in use place it below a hypothetical AV:N RCE of the same score. The 'Information Disclosure' input tag conflicts with the description, which states full takeover with C:H/I:H/A:H - the impact is far broader than information disclosure alone, so defenders should not down-scope remediation based on that tag.

An attacker positioned on the same network segment as a MySQL cluster node sends crafted Group Communication System (GCS) traffic to the Group Replication transport, exploiting the flaw without any credentials or user interaction to gain full control of the MySQL Server/Cluster instance. No public exploit code has been identified at the time of analysis. Because the CVSS vector is AV:A, the attacker must already have a foothold on the adjacent/replication network rather than attacking across the internet.