MySQL Router CVE-2026-101783

Exploitation targets the HTTPS network interface of Oracle MySQL Router version 26.7.0 (component Router: General). No authentication is required (PR:N) and no user interaction is needed (UI:N), so any attacker with network access to the Router's HTTPS service can attempt it. The primary limiting factor is high attack complexity (AC:H): Oracle explicitly rates it 'difficult to exploit,' indicating the attacker must meet specific, likely non-default or state-dependent conditions (timing, internal state, or configuration) that are outside their direct control, rather than sending a single deterministic request. Impact is confined to confidentiality and integrity of MySQL Router-accessible data; there is no availability/DoS impact (A:N) and no stated scope change (S:U).

This is a genuinely serious but not top-priority flaw based on the combined signals. The CVSS 3.1 base score of 7.4 (High) reflects a network-reachable (AV:N), unauthenticated (PR:N) vector with high confidentiality and integrity impact (C:H/I:H), but the high attack complexity (AC:H) is the dominant limiting factor - Oracle explicitly labels it 'difficult to exploit,' meaning successful attacks likely require specific conditions, timing, or state the attacker cannot fully control. No EPSS score, CISA KEV listing, or public POC was provided in the input, so there is no evidence of active or imminent widespread exploitation; exploitation status is 'no public exploit identified at time of analysis.' There is a signal conflict worth noting: the input Tags include 'Authentication Bypass,' yet the description characterizes the attacker as merely 'unauthenticated' (consistent with PR:N) and does not actually describe bypassing an authentication control - treat the auth-bypass characterization as unverified against the primary description. Availability impact is None (A:N), so this is a data confidentiality/integrity concern, not a denial-of-service risk. Net assessment: prioritize patching in MySQL Router 26.7.0 deployments given the unauthenticated network vector and high C/I impact, but the AC:H rating and absence of exploitation evidence place it below actively-exploited or trivially-exploitable issues.

A remote, unauthenticated attacker with network reachability to a MySQL Router 26.7.0 instance's HTTPS interface crafts and sends specially-tailored requests that, under the right conditions, let them read or alter data accessible to the Router. Because Oracle rates the flaw as difficult to exploit (AC:H), the attacker likely must satisfy non-trivial preconditions or win a race/state condition rather than fire a single reliable request. No public exploit code was identified in the provided data.