MySQL Server CVE-2026-101800

Exploitation requires the attacker to already possess a valid low-privileged account on the target MySQL Server or MySQL Cluster (PR:L) and network reachability over one of the supported MySQL protocols (AV:N). The vulnerability lies in the Server's Security: Privileges component. The key limiting factor is AC:H (high attack complexity): Oracle explicitly describes it as 'difficult to exploit,' meaning success depends on conditions or state the attacker cannot fully control, not a default one-shot request. No user interaction is required (UI:N). Affected and therefore vulnerable deployments are MySQL Server 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1 and MySQL Cluster 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; instances where untrusted or low-trust users hold database accounts are most exposed, while databases reachable only by fully trusted administrators face lower realistic risk.

This is a moderate-priority issue, not a top-tier emergency. The CVSS 3.1 base score of 6.8 (MEDIUM) reflects a genuinely constrained attack: AV:N gives network reach via multiple protocols, but AC:H (high complexity) means exploitation requires specialized conditions, timing, or state that an attacker cannot reliably control, and PR:L requires the attacker to already hold a valid low-privileged MySQL account. The impact is serious where it succeeds - C:H and I:H allow reading, creating, deleting, or modifying all database-accessible data - but A:N means no availability/denial-of-service dimension. No EPSS score, no CISA KEV listing, and no POC were provided in the input, so there is NO evidence of active exploitation or public exploit code; exploitation status is 'no public exploit identified at time of analysis.' The combination of AC:H plus PR:L substantially lowers real-world likelihood relative to the full-access impact, so this should be scheduled as routine Oracle CPU patching rather than emergency remediation. Note a metadata conflict: the input Tags list 'Authentication Bypass,' but the CVSS vector specifies PR:L (an authenticated, low-privileged attacker), which contradicts a true authentication bypass - this is a post-authentication privilege/authorization flaw, verify against the Oracle advisory.

An attacker who already holds a low-privileged MySQL account (for example, a limited application or reporting user) connects over the network via one of the supported protocols and exploits a flaw in the Server's privilege-handling logic to read, create, modify, or delete data they should not be able to reach, up to all database-accessible data. Because the CVSS vector is AC:H, the attack requires specific conditions or state that are not trivially reproducible. No public exploit code was identified in the provided intelligence.