Oracle MySQL CVE-2026-101802

Exploitation requires network access to the MySQL Server or Cluster listener over one of its supported protocols plus a valid low-privileged account able to submit SQL (PR:L) - the flaw is in the Server: Parser component, so the attacker must be able to send crafted SQL statements to the parser. Limiting factors: authentication is required (this is not an unauthenticated flaw), so the practical risk is driven by credential exposure, broad/shared DB logins, or an application-layer SQL-injection path that reaches the parser; impact is confined to availability (hang/complete DOS), with no confidentiality or integrity consequence. Affected builds are MySQL Server 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1 and MySQL Cluster 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; instances on unaffected/patched versions are not exploitable.

This is a moderate-severity availability-only vulnerability (CVSS 3.1 6.5, A:H with C:N/I:N) in the MySQL Server/Cluster SQL parser. The CVSS vector AV:N/AC:L/PR:L/UI:N indicates a network-reachable, low-complexity attack requiring only low privileges (PR:L) - i.e., any authenticated account that can submit queries - with no user interaction, which aligns with Oracle's 'easily exploitable' and 'low privileged attacker with network access via multiple protocols' language. The impact is strictly a hang or repeatable crash (complete DoS of the database), not data compromise or code execution. No EPSS score, CISA KEV listing, or public POC is present in the provided data, so there is no public exploit identified at time of analysis and no evidence of active exploitation. Net assessment: this is a real but mid-tier priority - the low privilege bar and network vector make it exploitable by any legitimate DB user (or a compromised application account via SQL injection), but the ceiling is availability loss only. Treat it as a patch-in-normal-cycle item unless the MySQL instance is internet-exposed or shares credentials broadly, in which case prioritize. Missing signals (EPSS, POC, exploitation telemetry) mean exploitation likelihood cannot be quantified beyond the favorable CVSS exploitability metrics.

An attacker holding any low-privileged MySQL account (or abusing a SQL-injection foothold in an application) connects over the network and submits a specially crafted SQL statement that the Server: Parser component mishandles, causing the mysqld process to hang or crash repeatably and taking the database offline. No public exploit code is identified at time of analysis; the AV:N/AC:L/PR:L vector means the attack is low-complexity and requires only a valid login with no user interaction.