Oracle MySQL Server CVE-2026-101784

Exploitation requires an authenticated session holding HIGH database privileges on MySQL Server or MySQL Cluster (CVSS PR:H), reachable over the network via one of multiple supported MySQL protocols; the malicious input is processed by the Server's Optimizer component. No user interaction is needed and attack complexity is low, so once privileged access exists the crash is reliably repeatable. The primary limiting factor is the high-privilege prerequisite - unprivileged or read-only users cannot trigger it - which confines realistic exploitation to trusted administrators, service accounts, or an attacker who has already captured privileged credentials. Affected versions: MySQL Server 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1.

This is a moderate-severity, availability-only vulnerability (CVSS 3.1 base 4.9) whose real-world risk is substantially constrained by its privilege requirement. The CVSS vector (AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H) shows network-reachable, low-complexity exploitation with no user interaction, but PR:H means the attacker must already hold high database privileges, which sharply limits the threat population to trusted/administrative accounts or a compromised privileged credential. Impact is limited to a hang or repeatable crash (complete DoS) of the Server; there is no confidentiality or integrity impact (C:N/I:N). No EPSS score, SSVC decision data, or CVE-specific CWE was provided, so automatable/technical-impact framing cannot be derived. The input contains no KEV listing and no POC reference, so exploitation status is 'no public exploit identified at time of analysis.' Net assessment: despite affecting a ubiquitous product, this is a lower-priority issue relative to RCE or auth-bypass flaws - the high privilege prerequisite and availability-only scope make it a legitimate but non-urgent patch-cycle item rather than an emergency, best remediated via Oracle's October 2026 Critical Patch Update.

An attacker who already possesses high-privilege MySQL credentials (e.g., a malicious insider, or an external attacker who has compromised an admin/service account) connects over the network via a supported protocol and issues a specially crafted query that the Server's Optimizer component mishandles, hanging or repeatably crashing the database and causing a complete denial of service. Because AC:L and UI:N, the crash is reliably triggerable once privileged access exists, but no public exploit code is identified at time of analysis.