MySQL Server CVE-2026-101788

Exploitation targets the 'Server: Components Services' component of MySQL Server (8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1) and MySQL Cluster (8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1), reachable over the network via multiple protocols without authentication or user interaction (PR:N/UI:N). The decisive limiting factor is high attack complexity (AC:H): Oracle explicitly labels it 'difficult to exploit,' indicating the attacker must satisfy conditions outside their control (e.g., specific server state or timing) rather than send a deterministic payload. Impact is confined to availability - a hang or frequently repeatable crash (complete DOS); there is no path to data disclosure or modification. Risk is further limited wherever the MySQL network port is firewalled, bound to localhost, or restricted to trusted hosts, which removes the network reachability the vector depends on.

This is a genuine but moderate-priority issue, best characterized as a high-CVSS-relative-to-real-risk denial-of-service bug rather than a top-tier emergency. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H, base 5.9) confirms a network-reachable, unauthenticated flaw with no confidentiality or integrity impact - only availability (complete DOS via hang or repeatable crash). The single most important mitigating signal is AC:H (high attack complexity), which Oracle's own prose reinforces with the phrase 'Difficult to exploit'; this means successful attack depends on conditions outside the attacker's control (timing, specific server state) rather than a trivially repeatable payload. No EPSS score was supplied in the input, so exploitation probability cannot be quantified. The CVE is NOT in CISA KEV and NO public exploit/POC is referenced, so exploitation status is 'no public exploit identified at time of analysis.' There is no conflict between the signals - all point consistently to a hard-to-exploit availability-only bug. The main caveat is data sparseness: the only primary reference is Oracle's October 2026 CPU landing page (not a per-CVE advisory), and CWE is N/A, so the exact fault class and trigger mechanism are unconfirmed.

An attacker with network reachability to an exposed MySQL Server or Cluster instance sends specially crafted traffic over one of the supported protocols to trigger a fault in the Server Components Services, causing the daemon to hang or repeatedly crash and denying service to all legitimate clients. Because the CVSS vector specifies PR:N/UI:N, no authentication or user interaction is needed, but the AC:H rating and Oracle's 'difficult to exploit' language mean the attacker likely needs to win a race or hit a narrow condition, so reliable one-shot exploitation is unlikely. No public proof-of-concept exploit is known at time of analysis.