MySQL Server CVE-2026-101786

Exploitation requires the attacker to already possess a high-privilege MySQL account (PR:H) - administrative or elevated-grant credentials on the target MySQL Server or Cluster instance; it cannot be triggered by anonymous or low-privilege users. Given AV:N, the attacker needs network reachability to the database over one of MySQL's supported protocols, and no user interaction (UI:N) or special configuration is needed beyond a reachable, running MySQL Server/Cluster at version 26.7.0-26.7.1 with the Server: Optimizer component in use (default). The primary limiting factor is the high-privilege prerequisite, which confines realistic exploitation to malicious insiders or scenarios where admin-level database credentials have already been compromised; restricting and monitoring privileged DB accounts and network exposure of the MySQL port substantially reduces real risk.

The CVSS 3.1 base score is 7.2 (High) with vector AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, indicating network-reachable, low-complexity exploitation that nonetheless requires high privileges (PR:H) - meaning the attacker must already hold an administrative/high-privilege MySQL account before the flaw yields full confidentiality, integrity, and availability compromise (product takeover). No EPSS score was provided in the input, and the CVE is NOT listed in CISA KEV; no public proof-of-concept was supplied. Oracle labels it 'easily exploitable,' which aligns with AC:L, but the PR:H requirement materially lowers real-world risk: an unprivileged or anonymous attacker cannot leverage this. There is no SSVC decision data in the input. The dominant signal is therefore the high-privilege precondition, which contradicts the 'easily exploitable' framing for any environment that properly restricts admin credentials - this is a privileged-insider / post-authentication escalation issue rather than a mass-exploitable perimeter flaw. The lone input Tag 'Information Disclosure' understates the actual impact (full takeover across C/I/A per the vector); treat the vector, not the tag, as authoritative.

An attacker who has already obtained a high-privilege MySQL account (e.g., a malicious DBA, a compromised admin credential, or a service account with elevated grants) connects over the network via one of the supported MySQL protocols and submits input that exercises a flaw in the Server Optimizer component. The malformed query/optimizer path leads to full compromise (takeover) of the MySQL Server or Cluster instance. No public exploit identified at time of analysis, and no user interaction is required.