MySQL Server CVE-2026-101798

Exploitation requires an attacker to already possess high-privilege credentials on the target (PR:H) and network reach to the MySQL Server/Cluster via one of the supported protocols; the flaw is triggered through the Server: Optimizer component. Affected builds are MySQL Server 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1 and MySQL Cluster 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1. The decisive limiting factor is the high-privilege prerequisite: an unprivileged or external attacker cannot reach this condition, so realistic abuse comes from a malicious or compromised privileged account rather than anonymous attackers. Impact is limited to denial of service (no data disclosure or modification).

This is a moderate-severity availability-only flaw, consistent with its CVSS 3.1 base score of 4.9. The vector (AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H) shows network reach and low attack complexity, but critically requires PR:H - high privileges on the MySQL Server/Cluster - which sharply limits the attacker population to users who already hold elevated database credentials. Impact is confined to availability (C:N/I:N/A:H): a hang or repeatable crash producing a complete denial of service, with no confidentiality or integrity consequence. No EPSS score, KEV listing, SSVC decision, or POC was provided in the input, so there is no signal of active or probable exploitation; status is no public exploit identified at time of analysis. The signals are internally consistent - Oracle's own 'easily exploitable' phrasing aligns with AC:L, while the 'high privileged' phrasing aligns with PR:H - so this reads as a genuine but lower-priority issue: real and patchable, but gated behind privileged access and limited to DoS rather than a widely weaponizable critical bug. The main caveat is that EPSS and POC data are simply absent (not confirmed negative), so exploitation likelihood could not be quantified.

An attacker who already holds high-privilege MySQL credentials (or has compromised such an account) connects over the network via one of the supported protocols and submits a crafted query that the Server: Optimizer component mishandles, causing the server to hang or repeatedly crash. The result is a complete denial of service for the MySQL Server or Cluster. No public proof-of-concept exploit was identified in the provided data.