MySQL Server CVE-2026-101795

Exploitation requires the attacker to already have a high-privileged account able to log on to the infrastructure (operating system/host) where MySQL Server or MySQL Cluster executes; the attack targets the 'Server: Components Services' component. The decisive limiting factor is PR:H combined with AV:L - this is not remotely reachable and cannot be triggered by an unauthenticated or low-privileged user. Affected: MySQL Server 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1. No user interaction is required (UI:N), but the required pre-existing high privilege on the host sharply narrows the realistic attacker population to insiders or already-compromised privileged accounts.

Signals are moderate and internally consistent. The CVSS 3.1 base score is 6.7 (MEDIUM), driven by AV:L (local/logon required), AC:L, and critically PR:H - the attacker must already hold high privileges on the host where MySQL Server/Cluster runs. Offsetting that gatekeeper is full C:H/I:H/A:H impact: Oracle's own wording says successful attacks can result in complete takeover of MySQL Server/Cluster. No EPSS score, CISA KEV entry, or public POC is present in the provided data, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The practical result is a relatively low real-world priority despite the alarming 'takeover' language: the PR:H + AV:L combination means the attacker must already be a privileged local user, making this a privilege-consolidation/post-compromise issue rather than an internet-facing entry point. One inconsistency to verify: the 'Information Disclosure' tag understates the issue, which the CVSS vector scores as full confidentiality, integrity, and availability compromise, not mere disclosure.

An attacker who already has high-privileged local access (e.g. an OS account able to log on to the database host, or a compromised DBA/service account) abuses the Server: Components Services component to escalate to full control of the MySQL Server/Cluster instance. No user interaction is required and attack complexity is low, but the attacker must first obtain the privileged local foothold. No public exploit code is identified at time of analysis.