MySQL Server CVE-2026-101794

Exploitation requires an authenticated low-privileged MySQL account (PR:L) with network access to the server over one of the supported MySQL protocols; it targets the Server: XML component, so processing of XML input/functions is the relevant code path. Affected builds are MySQL Server 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1 and MySQL Cluster 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1. Limiting factors: the attacker must already possess valid (even if minimal) credentials - this is not unauthenticated - and the maximum impact is a denial of service only, with no path to data disclosure or modification. Network exposure of the MySQL port to untrusted or semi-trusted accounts is the practical precondition.

This is a moderate, availability-only vulnerability whose risk is driven by product ubiquity rather than exploit severity. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, 6.5 MEDIUM) confirms a network-reachable, low-complexity flaw requiring low privileges (PR:L = an authenticated low-privileged account), with no user interaction, and impact confined entirely to availability (C:N/I:N) - a complete DoS via hang or repeatable crash of the server. There is NO confidentiality or integrity exposure, so this is not a data-breach or RCE risk. No EPSS score was provided in the input, and there is no CISA KEV listing and no POC reference, so the signals are: no public exploit identified at time of analysis. The absence of KEV/EPSS/POC combined with an availability-only, authentication-gated profile means this is a patch-in-normal-cycle issue rather than an emergency, despite MySQL's enormous footprint. One caveat: the Oracle description calls it 'easily exploitable' and lists 'multiple protocols,' which aligns with AV:N/AC:L, but Oracle's advisory gives no technical detail on the Server: XML component trigger - verify specifics against the October 2026 CPU when available.

An attacker holding any low-privileged MySQL account (e.g., a compromised application or tenant credential) connects to the server over the network via one of the supported protocols and submits a crafted request to the XML-handling component. The malformed input drives the server into a hang or repeatable crash, producing a complete denial of service for all database clients. No public exploit code is identified at time of analysis, and no authentication bypass is involved - the attacker must already be authenticated.